Risk mitigation

ISO/IEC 27005 calls this option risk modification, and ISO 31000:2018 clause 6.5.2 splits it into changing the likelihood and changing the consequences, alongside removing the risk source. The distinction matters for control selection. Likelihood-reducing controls act before an event: patching, MFA, network segmentation, application allow-listing and secure configuration. Consequence-reducing controls act during or after it: offline backups with tested restores, immutable logging, encryption of data at rest so stolen media is less harmful, and incident response and continuity plans. A risk dominated by impact, such as ransomware against a critical system, is rarely brought within appetite by prevention alone, because no preventive control is perfect.

ISO/IEC 27002:2022 tags each of its 93 controls with attributes, including control type (preventive, detective, corrective) and cybersecurity concept (identify, protect, detect, respond, recover), which makes it possible to check that a treatment plan does not rely on a single type. ISO/IEC 27001:2022 clause 6.1.3 b) requires the organisation to determine all controls necessary to implement the chosen treatment, from any source; c) to compare them with Annex A to verify that no necessary control has been omitted; and d) to produce a Statement of Applicability listing the necessary controls, whether they are implemented, and the justification for including or excluding each Annex A control. Annex A is a checklist against omission, not a catalogue that must be adopted wholesale.

The expected effect of each control is an assumption until verified. Assurance practice distinguishes design effectiveness, whether the control as specified would address the scenario, from operating effectiveness, whether it actually worked over a period, the difference behind SOC 2 Type I and Type II reports. Residual ratings should be based on evidence such as test results, coverage metrics and incident data, not on a control merely being listed. Compensating controls are used when the preferred control is not feasible, for example extra monitoring and network isolation around a legacy system that cannot be patched, and should be documented with the gap they cover.

Mitigation shows diminishing returns: the first controls against a risk usually remove most of the likelihood cheaply, and each further increment costs more. Defence in depth justifies layering, but beyond the point where marginal cost exceeds the marginal reduction in expected loss, acceptance or transfer of the remainder is the rational choice. Unlike transfer, mitigation changes the risk itself; unlike avoidance, the activity continues.