Risk Mitigation
What is Risk Mitigation?
Actions taken to reduce the likelihood or impact of an identified risk to an acceptable level through implementing controls or other measures.
Terms that appear alongside risk mitigation
Each of these is named in at least one of the same controls as risk mitigation. The number is how many controls name both.
- risk assessment 3 shared controls
- risk appetite 3 shared controls
- encryption 2 shared controls
- breach notification 2 shared controls
- compliance 2 shared controls
- compliance verification 2 shared controls
- data protection 2 shared controls
- cybersecurity 2 shared controls
Frameworks that govern risk mitigation
What the standards actually require on risk mitigation
Requirements naming risk mitigation across 6 standards, quoted from the control text.
Establish, implement and maintain measures to mitigate identified risks of harm and biased output.
AIDA-13 · Risk Mitigation Measures →Institutions shall take measures to mitigate identified ICT and security risks, including the protection measures in the information security section, and address residual risk in line with their risk appetite.
EBA-GL-3.3.4 · Risk mitigation →Mitigation strategies including accept, transfer, avoid, or reduce are selected based on risk appetite and cost-benefit analysis.
IS-III.B.3 · Risk Mitigation Strategy →Section 43 of the Kenya DPA establishes the Personal Data Breach Notification framework. (1) Section 43(1) Personal Data Breach Definition: (a) Breach of security leading to accidental or unlawful (i) destruction; (ii) loss; (iii) alteration;
KE-DPA-Breach-Notification-Sections43-72-Hour-ODPC-Affected-Subjects-Mitigation-Documentation · Kenya DPA Personal Data Breach Notification + Section 43 + 72-Hour ODPC + Affected Data Subjects High Risk + Mitigation + Documentation + Processor Notification Chain + Cross-Border Coordination →Even on an LTE network, SS7 interworking with legacy 2G and 3G partners can expose subscribers to tracking and interception. Deploy an SS7 firewall, restrict global title routing, and monitor MAP messages for known attack signatures.
SP800-187-3.10 · SS7 Interworking Risk Mitigation →Organizations must implement and document risk-mitigation practices appropriate for their PIN and key processing environment, including risk assessments, security policies, and incident response plans.
CO-19 · Organizations Implement and Document Risk-Mitigation Practices →Questions people ask about risk mitigation
What is Risk Mitigation?
Why is Risk Mitigation important for compliance?
Which compliance frameworks address Risk Mitigation?
Where can I learn more about Risk Mitigation?
See how Risk Mitigation applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.