Managing Information Security Risk: Organization, Mission, and Information System View
Appendix H); and (vii) the general organizational directions and guidance on appropriate responses to risk. In addition > TASK 3-1: Identify alternative courses of action to respond to risk determined during the risk assessment.

TASK 3-1: Identify alternative courses of action to respond to risk determined during the risk assessment.

Supplemental Guidance: Organizations can respond to risk in a variety of ways. These include: (i) risk acceptance; (ii)
risk avoidance; (iii) risk mitigation; (iv) risk sharing; (v) risk transfer; or (vi) a combination of the above. A course of
action is a time-phased or situation-dependent combination of risk response measures. For example, in an emergency
situation, organizations might accept the risk associated with unfiltered connection to an external communications
provider for a limited time; then avoid risk by cutting the connection; mitigate risk in the near-term by applying
security controls to search for malware or evidence of unauthorized access to information that occurred during the
period of unfiltered connection; and finally mitigate risk long-term by applying controls to handle such connections
more securely.
Risk Acceptance
Risk acceptance is the appropriate risk response when the identified risk is within the organizational risk tolerance.
Organizations can accept risk deemed to be low, moderate, or high depending on particular situations or conditions. For
example, organizations with data centers residing in the northeastern portion of the United States may opt to accept the
risk of earthquakes based on known likelihood of earthquakes and data center vulnerability to damage by earthquakes.
Organizations accept the fact that earthquakes are possible, but given the infrequency of major earthquakes in that
region of the country, believe it is not cost-effective to address such risk-that is, the organizations have determined
that risk associated with earthquakes is low. Conversely, organizations may accept substantially greater risk (in the
moderate/high range) due to compelling mission, business, or operational needs. For example, federal agencies may
decide to share very sensitive information with first responders who do not typically have access to such information
due to time-sensitive needs to stop pending terrorist attacks, even though the information is not itself perishable with
regard to risk through loss of confidentiality. Organizations typically make determinations regarding the general level
of acceptable risk and the types of acceptable risk with consideration of organizational priorities and trade-offs
between: (i) near-term mission/business needs and potential for longer-term mission/business impacts; and (ii)
organizational interests and the potential impacts on individuals, other organizations, and the Nation.
Risk Avoidance
Risk avoidance may be the appropriate risk response when the identified risk exceeds the organizational risk tolerance.
Organizations may conduct certain types of activities or employ certain types of information technologies that result in
risk that is unacceptable. In such situations, risk avoidance involves taking specific actions to eliminate the activities or
technologies that are the basis for the risk or to revise or reposition these activities or technologies in the organizational
mission/business processes to avoid the potential for unacceptable risk. For example, organizations planning to employ
networked connections between two domains, may determine through risk assessments that there is unacceptable risk
in establishing such connections. Organizations may also determine that implementing effective safeguards and
countermeasures (e.g., cross-domain solutions) is not practical in the given circumstances. Thus, the organizations
decide to avoid the risk by eliminating the electronic or networked connections and employing an "air gap" with a
manual connection processes (e.g., data transfers by secondary storage devices).
Risk Mitigation
Risk mitigation, or risk reduction, is the appropriate risk response for that portion of risk that cannot be accepted,
avoided, shared, or transferred. The alternatives to mitigate risk depend on: (i) the risk management tier and the scope
of risk response decisions assigned or delegated to organizational officials at that tier (defined by the organizational
governance structures); and (ii) the organizational risk management strategy and associated risk response strategies.
The means used by organizations to mitigate risk can involve a combination of risk response measures across the three
tiers. For example, risk mitigation can include common security controls at Tier 1, process re-engineering at Tier 2,
and/or new or enhanced management, operational, or technical safeguards or countermeasures (or some combination of
all three) at Tier 3. Another example of a potential risk requiring mitigation can be illustrated when adversaries gain
access to mobile devices (e.g., laptop computers or personal digital assistants) while users are traveling. Possible risk
mitigation measures include, for example, organizational policies prohibiting transport of mobile devices to certain
areas of the world or procedures for users to obtain a clean mobile device that is never allowed to connect to the
organizational networks.
Risk Sharing or Transfer
Risk sharing or risk transfer is the appropriate risk response when organizations desire and have the means to shift risk
liability and responsibility to other organizations. Risk transfer shifts the entire risk responsibility or liability from one
organization to another organization (e.g., using insurance to transfer risk from particular organizations to insurance
companies). Risk sharing shifts a portion of risk responsibility or liability to other organizations (usually organizations
that are more qualified to address the risk). It is important to note that risk transfer reduces neither the likelihood of
harmful events occurring nor the consequences in terms of harm to organizational operations and assets, individuals,
other organizations, or the Nation. Risk sharing may be a sharing of liability or a sharing of responsibility for other,
adequate risk responses such as mitigation. Therefore, the concept of risk transfer is less applicable in the public sector
(e.g., federal, state, local governments) than the private sector, as liability of organizations is generally established by
legislation or policy. As such, self-initiated transfers of risk by public sector organizations (as typified by purchasing
insurance) are generally not possible. Risk sharing often occurs when organizations determine that addressing risk
requires expertise or resources that are better provided by other organizations. For example, an identified risk might be
the physical penetration of perimeters and kinetic attacks by terrorist groups. The organization decides to partner with
another organization sharing the physical facility to take joint responsibility for addressing risk from kinetic attacks.
EVALUATION OF ALTERNATIVES