The four risk treatment strategies — with ALE/SLE/ARO formulas, risk matrix, control types, and a 10-question scenario quiz modeled on real CISSP exam items.
🧪 Take the 10-Question Quiz →Every CISSP risk scenario maps to one of these four responses. Recognizing the signals is the exam skill.
Select a strategy to see when to use it, how it works, and key CISSP exam signals.
Avoidance is not about adding controls — it's about removing the source of the risk entirely. If the business activity creating the risk is eliminated, the risk goes with it.
Avoidance is typically applied to risks in the top-right zone (critical/high likelihood + high impact).
Transference moves the financial consequence of a risk event to a third party — typically an insurer or service provider. The risk itself is not eliminated; someone else now bears the cost if it materializes.
Mitigation applies security controls to reduce the likelihood a threat materializes, reduce the impact when it does, or both. Controls are only worth implementing if they're cost-effective.
All security controls fall into one category and one or more functions.
| Function | Purpose | Examples |
|---|---|---|
| Preventive | Stops the threat before it occurs | Firewall, encryption, MFA, least privilege |
| Detective | Identifies that a threat has occurred | IDS, audit logs, SIEM, security cameras |
| Corrective | Restores systems after an incident | Backups, patch management, incident response |
| Deterrent | Discourages attackers | Warning banners, visible cameras, guards |
| Compensating | Alternative when primary control is infeasible | Manual review when MFA not available |
| Directive | Mandates or directs behavior | Policies, procedures, employment contracts |
Acceptance is a deliberate, documented decision to live with a risk. It is appropriate when the cost of controls exceeds the potential loss, or when risk falls below the organization's risk appetite. It is NOT the same as ignoring risk.
All four risk treatment strategies across every CISSP-relevant dimension.
| Criteria | 🔴 Avoidance | 🔵 Transference | 🟢 Mitigation | 🟣 Acceptance |
|---|---|---|---|---|
| DefinitionBasics | Eliminate the activity, system, or process that generates the risk | Shift financial burden to a third party via insurance or contract | Reduce likelihood or impact through security controls | Formally acknowledge and live with the risk without action |
| Does Risk Disappear?Basics | ✅ Yes — source activity removed | ❌ No — risk remains; cost is shifted | 🔶 Partially — residual risk remains | ❌ No — risk acknowledged, not addressed |
| Cost ImplicationBasics | Opportunity cost of not pursuing the activity | Ongoing premium or contract cost | Capital + operational cost of controls | Lowest upfront cost; highest potential loss |
| Legal AccountabilityBasics | ✅ Eliminated with the activity | ❌ Stays with organization | 🔶 Reduced but not eliminated | ❌ Fully retained by organization |
| Residual RiskBasics | None (if activity fully stopped) | Yes — org still exposed to non-financial consequences | Yes — controls are never 100% effective | All of it — no controls applied |
| Best Used When…When to Use | Risk is critical/uncontrollable; no controls are feasible; liability is too great | Risk is real but controls alone can't reduce it enough; insurance is affordable | Controls are cost-effective (ALE reduction > control cost); risk is significant | ALE < cost of controls; risk falls below risk appetite; low-priority risk |
| Risk Level TypicalWhen to Use | Critical / Extreme | Medium / High (affordable to insure) | Medium / High (controllable) | Low / Minimal (below threshold) |
| Documentation Required?When to Use | ✅ Decision rationale | ✅ Policy, contract, coverage details | ✅ Control implementation records | ✅ Formal risk acceptance statement + authority sign-off |
| CISSP Exam Signal WordsExam Signals | "decided not to," "discontinued," "chose not to implement," "shut down," "air-gapped," "will not proceed" | "purchased insurance," "SLA with penalties," "outsourced to," "third-party assumed," "cyber liability policy" | "installed," "implemented controls," "deployed," "trained employees," "encrypted," "patched," "MFA" | "formally accepted," "CISO signed off," "documented in risk register," "cost exceeds benefit," "below threshold" |
| Common Exam TrapExam Signals | Confusing avoidance with mitigation — avoidance removes the activity, not just the risk | Thinking transference eliminates accountability — it never does | Implementing controls that cost more than the ALE they reduce → use acceptance instead | Confusing informal "ignoring" of risk with formal documented acceptance |
Six scenarios directly modeled on CISSP exam question formats.
Scenario-based items modeled on real exam format. Reasoning required — not memorization.
Answer 3 questions to identify the right approach for any CISSP risk scenario.
Click each card to flip and reveal the mnemonic. Built for rapid recall under exam pressure.
Four formulas. Memorize the order. AV → EF → SLE → ARO → ALE → control value.
| Formula | Stands For | What It Means |
|---|---|---|
| AV × EF = SLE | Asset Value × Exposure Factor = Single Loss Expectancy | How much ONE incident costs. EF is the % of asset lost (0–100%). |
| SLE × ARO = ALE | Single Loss Expectancy × Annualized Rate of Occurrence | Expected annual cost of the risk. ARO = 0.25 means once per 4 years. |
| ALE(b) − ALE(a) − Cost = Value | ALE Before − ALE After − Annual Control Cost | Net benefit of implementing a control. If positive → implement. If negative → accept. |
| Total Risk − Controls = Residual Risk | Conceptual formula | The risk remaining after all controls are applied. Must be formally accepted. |
| If the question says… | Think… | Answer |
|---|---|---|
| "decided not to," "shut down," "discontinued," "will not implement," "air-gapped and removed" | 🔴 Removed the activity entirely | Risk Avoidance |
| "purchased insurance," "SLA with penalties," "outsourced to provider," "third-party contract" | 🔵 Shifted the financial burden | Risk Transference |
| "installed firewall," "deployed MFA," "implemented patch management," "security awareness training" | 🟢 Applied controls to reduce risk | Risk Mitigation |
| "CISO signed off," "documented in risk register," "cost of control exceeds ALE," "formally accepted" | 🟣 Acknowledged and filed | Risk Acceptance |
| "outsourced but still accountable" → what is true? | 🔵 Transfer ≠ accountability transfer | Org retains legal liability |
| "risk remaining after controls" = ? | All controls leave some risk | Residual Risk |
