{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/risk-treatment","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/risk-treatment/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/risk-treatment/"},"term":{"en":"Risk treatment","da":"Risikohåndtering"},"aka":{"en":["risk response"],"da":[]},"domain":["security"],"cluster":"risk-management","layer":"governance","status":"current","summary":{"en":"Choosing what to do about each risk - accept it, reduce it, share it with someone else, or avoid it altogether.","da":"Valget af, hvad man gør ved hver risiko - accepterer den, mindsker den, deler den med andre eller undgår den helt."},"body":{"formal":{"en":"The step in risk management where each assessed risk gets one of four responses - retained as it is, reduced with controls, shared with or transferred to another party, or avoided by stopping the activity - each with an owner and a plan.","da":"Trinnet i risikostyringen, hvor hver vurderet risiko får én af fire håndteringer - den accepteres, mindskes med kontroller, deles med eller overføres til en anden part eller undgås ved at stoppe aktiviteten - hver med en ejer og en plan."},"plain":{"en":"Like facing a leaky roof - you can live with it, patch it, buy insurance, or move out.","da":"Ligesom med et utæt tag - man kan leve med det, lappe det, tegne en forsikring eller flytte."},"inPractice":{"en":"A shipping company's board buys cyber insurance to share the cost of a ransomware attack, adds MFA to reduce the risk from stolen passwords, and accepts the small risk of an office printer failing.","da":"Bestyrelsen i et rederi tegner en cyberforsikring for at dele udgifterne ved et ransomware-angreb, indfører MFA for at mindske risikoen ved stjålne adgangskoder og accepterer den lille risiko for, at en kontorprinter svigter."},"whyItMatters":{"en":"Finding risks is pointless without a decision about each one, and that decision shows who owns it and what it costs.","da":"Det nytter ikke at finde risici uden en beslutning om hver enkelt, og den beslutning viser, hvem der ejer risikoen, og hvad den koster."}},"deepDive":{"en":"The familiar four options are a simplification. ISO 31000:2018 clause 6.5.2 lists seven: avoiding the risk by not starting or continuing the activity; taking or increasing the risk to pursue an opportunity; removing the risk source; changing the likelihood; changing the consequences; sharing the risk, for example through contracts or insurance; and retaining the risk by informed decision. NIST SP 800-39 uses five risk responses, separating sharing from transfer, while ISO/IEC 27005 has traditionally grouped the options as modification, retention, avoidance and sharing. The options are not mutually exclusive: a typical ransomware treatment combines mitigation (MFA, segmentation, offline backups), sharing (cyber insurance for the tail) and formal retention of what is left.\n\nISO/IEC 27001:2022 clause 6.1.3 turns treatment into a sequence of auditable steps: a) select treatment options in light of the assessment results; b) determine all controls necessary to implement them, from any source; c) compare those controls with Annex A to verify that nothing necessary has been omitted; d) produce the Statement of Applicability with justification for inclusions and exclusions; e) formulate a risk treatment plan; and f) obtain the risk owners' approval of the plan and their acceptance of the residual risks. Clause 8.3 then requires the plan to be implemented and its results retained.\n\nISO 31000:2018 clause 6.5.3 describes what a treatment plan should contain: the rationale for the chosen options including expected benefits, who is accountable for approving and implementing it, the proposed actions, resources, performance measures, constraints, required reporting and monitoring, and timing. In practice this means each treated risk is linked in the register to named actions, an owner, a deadline, a budget line and the expected residual rating, so that monitoring can later compare the expected with the achieved effect.\n\nSelection is a cost-benefit decision bounded by obligations. Legal and contractual requirements can rule options out entirely (a mandatory control cannot simply be retained away), stakeholder expectations and ethics count alongside expected-loss arithmetic, and ISO 31000 notes that treatment can introduce new risks and may not work as intended, so treatments must themselves be monitored. Treatment differs from incident response despite the similar-sounding synonym risk response: treatment decides in advance how a risk will be handled, whereas incident response deals with an event that has already occurred.","da":"De velkendte fire muligheder er en forenkling. ISO 31000:2018 punkt 6.5.2 nævner syv: at undgå risikoen ved ikke at starte eller fortsætte aktiviteten; at tage eller øge risikoen for at forfølge en mulighed; at fjerne risikokilden; at ændre sandsynligheden; at ændre konsekvenserne; at dele risikoen, fx via kontrakter eller forsikring; og at bibeholde risikoen ved en informeret beslutning. NIST SP 800-39 bruger fem risikoreaktioner og skelner mellem deling og overførsel, mens ISO/IEC 27005 traditionelt samler mulighederne som modifikation, bibeholdelse, undgåelse og deling. Mulighederne udelukker ikke hinanden: En typisk håndtering af ransomware kombinerer reduktion (MFA, segmentering, offline backup), deling (cyberforsikring til de største tab) og formel accept af det, der er tilbage.\n\nISO/IEC 27001:2022 punkt 6.1.3 gør håndteringen til en række trin, der kan auditeres: a) vælge håndteringsmuligheder ud fra vurderingens resultater; b) fastlægge alle de kontroller, der er nødvendige for at gennemføre dem, fra en hvilken som helst kilde; c) sammenholde kontrollerne med bilag A for at sikre, at intet nødvendigt er udeladt; d) udarbejde en Statement of Applicability med begrundelse for, hvad der er medtaget og udeladt; e) udforme en risikohåndteringsplan; og f) indhente risikoejernes godkendelse af planen og deres accept af de residuale risici. Punkt 8.3 kræver derefter, at planen gennemføres, og at resultaterne dokumenteres.\n\nISO 31000:2018 punkt 6.5.3 beskriver, hvad en håndteringsplan bør indeholde: begrundelsen for de valgte muligheder med de forventede gevinster, hvem der er ansvarlig for at godkende og gennemføre planen, de foreslåede handlinger, ressourcer, præstationsmål, begrænsninger, krav til rapportering og overvågning samt tidsplan. I praksis betyder det, at hver håndteret risiko i registret knyttes til navngivne handlinger, en ejer, en frist, en budgetpost og den forventede residuale vurdering, så overvågningen senere kan sammenligne den forventede med den opnåede effekt.\n\nValget er en cost-benefit-beslutning inden for rammerne af forpligtelser. Lov- og kontraktkrav kan udelukke muligheder helt (et obligatorisk krav kan ikke bare accepteres væk), interessenternes forventninger og etik tæller ved siden af regnestykket over forventet tab, og ISO 31000 påpeger, at håndtering kan skabe nye risici og måske ikke virker som tiltænkt, så håndteringerne selv skal overvåges. Risikohåndtering er ikke det samme som hændelseshåndtering, selv om det engelske synonym risk response lyder beslægtet: Risikohåndtering afgør på forhånd, hvordan en risiko skal håndteres, mens hændelseshåndtering tager sig af noget, der allerede er sket."},"edges":[{"type":"requires","to":"security/risk","confidence":"high","strength":"normal"},{"type":"requires","to":"security/control","confidence":"high","strength":"normal"},{"type":"requires","to":"security/risk-assessment","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/risk-management","confidence":"high","strength":"normal"},{"type":"causes","to":"security/residual-risk","confidence":"high","strength":"normal"}],"depth":5,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"ISO/IEC 27005:2022","tier":"standard"}],"draft":true}