Risk mitigation vs Risk transfer

Why they differ

Mitigation lowers the risk itself; transfer leaves the risk unchanged but moves its cost to another party.

Risk management

Lowering a risk by adding controls that make it less likely to happen or less harmful if it does.

Formal

The risk treatment option in which controls are chosen and put in place to reduce the likelihood, the impact, or both, until the remaining risk falls within the risk appetite.

In plain English

Like putting a rubber mat in the shower and a grab bar by the bath - you still wash, but a fall is less likely and less bad if it happens.

In practice

After fraud attempts, an unemployment fund requires a second case officer to approve any change of a member's bank account and has staff call the member back first; the risk moves from high to medium.

Why it matters

It is by far the most used option and the one most security work is about, but a risk is never removed this way - some always remains.

Risk transfer

Risk management

Moving the financial cost of a risk to another party, usually through insurance or a contract with a supplier.

Formal

The risk treatment option in which some or all of the consequences of a risk are shared with or passed to a third party - for example through cyber insurance or contract terms with a supplier - while accountability for the risk stays with the organisation.

In plain English

Like hiring a removal firm that pays if it drops your piano - you get the money back, but you still have no piano for the party on Saturday.

In practice

A Danish online furniture shop takes out cyber insurance that pays for outside experts and lost income after an attack, and its contract makes the hosting provider cover losses from the provider's own outages.

Why it matters

Money can be moved, but the lost trust, the lost data and the legal duties cannot - an insured organisation must still report breaches and answer to its customers.

Shared connections

Risk treatment