Risk Reduction
What is Risk Reduction?
Actions taken to decrease the probability or impact of a risk event through the implementation of controls and other mitigation measures.
Frameworks that govern risk reduction
What the standards actually require on risk reduction
Requirements naming risk reduction across 6 standards, quoted from the control text.
Senior agency officials implement policies and procedures that cost-effectively reduce the risks to their information and systems to an acceptable level.
fisma::3554(a)(2)(C) · 3554(a)(2)(C) Senior officials implement cost-effective risk reduction →A plan is prepared covering the routine actions that keep functional safety in place; the actions and constraints needed in start-up, routine running and testing, foreseeable upsets, faults and shutdown to avoid an unsafe state, cut demands on the safety syste...
iec-61508-2010-functional-safety-of-e-e-pe-safety-related-systems::1-7.7.2 · Part 1, 7.7.2 Overall operation and maintenance planning: requirements →Outputs include decisions and actions on: improving the effectiveness of the resilience policy; updating the risk assessment, incident preparedness and response plans;
iso-28002-2011::A.7.3 · A.7.3 Management review output →A documented process confirms that selected treatments are implemented as planned and on time, reviewed by the risk owner and governance fora, with independent oversight that validates the risk reduction and that residual risk sits within tolerance.
uk-onr-cyber-security-and-information-assurance-csia-for-nuclear-facilities::7.1-TI · Risk treatment: implementation →The organization should carry out a cost-benefit analysis of candidate controls and countermeasures, for individual PPS and for integrated systems, measuring effectiveness and efficiency against the level of risk the organization has agreed to reduce, avoid or...
ansi-asis-pap-1-2012-physical-asset-protection::B.1.3 · B.1.3 Cost-benefit analysis of controls over the full life cycle →Output from management review must cover decisions and actions on: making the system more effective; bringing the risk assessment, the impact analysis and the incident preparedness and response plans up to date;
asis-spc-1-2009-organizational-resilience-standard::4.6.3 · 4.6.3 Review outputs: system improvement, updated risk assessment and plans, modified procedures and controls, resources and measurement →Questions people ask about risk reduction
What is Risk Reduction?
Why is Risk Reduction important for compliance?
Which compliance frameworks address Risk Reduction?
Where can I learn more about Risk Reduction?
See how Risk Reduction applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.