Risk Response
What is Risk Response?
The selection and implementation of options for addressing risk, including avoidance, reduction, sharing, transfer, or acceptance.
Terms that appear alongside risk response
Each of these is named in at least one of the same controls as risk response. The number is how many controls name both.
- nist 3 shared controls
- risk tolerance 2 shared controls
- authorisation 2 shared controls
- supply chain risk 2 shared controls
Frameworks that govern risk response
What the standards actually require on risk response
Requirements naming risk response across 6 standards, quoted from the control text.
Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.
NIST800-RA-7 · RA-7 Risk Response →The plan must require that the risk assessment process determines and prioritises risk response options, and that the managers answerable for the segregated environment's safety, integrity and reliability review and approves the risk assessment results before...
api-1164::ID.RA-6 · ID.RA-6 Risk response options determined, prioritised and approved by accountable management before action →Leadership reviews risk responses such as mitigate, accept, avoid or transfer periodically to confirm they are still appropriate.
australian-energy-sector-cyber-security-framework-aescsf::RISK-4e · RISK-4e: Leadership periodically reviews risk responses →Strategic direction that describes appropriate risk response options is established and communicated
NIST-CSF-GV.RM-04 · Strategic direction that describes appropriate risk response options is established and communicated →Risk responses are identified and chosen. For each risk identified, management picks and puts in place a response (accept, avoid, pursue, reduce or share), weighing how severe the risk is and how high it ranks, the business context and the associated business...
coso-enterprise-risk-management-erm-framework-2017::P13 · Principle 13: Implements Risk Responses →CSF 2.0 outcome: risk responses are chosen, prioritized, planned, tracked and communicated. Priority High. N1: risk responses are needed to prevent future incidents and stop existing ones recurring.
nist-sp-800-61-rev-3::ID.RA-06 · ID.RA-06 Criteria guide risk response decisions to prevent incidents and recurrence →Questions people ask about risk response
What is Risk Response?
Why is Risk Response important for compliance?
Which compliance frameworks address Risk Response?
Where can I learn more about Risk Response?
See how Risk Response applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.