What is risk treatment?

• A. Replacing all systems periodically.
• B. Measuring risk but not acting.
• C. Ignoring risk to save time.
• D. Selecting and implementing measures to mitigate, transfer, avoid, or accept risk.

Answer: (D)

Risk treatment is the process of selecting and implementing actions to address risks by reducing, transferring, avoiding, or accepting them. After risks are identified and assessed, you choose appropriate responses to bring the overall risk to an acceptable level and then put those measures into place, continually monitoring residual risk. For example, you might add security controls to lower likelihood or impact, contract or insure to transfer risk, change plans to avoid the risk, or simply accept it if it’s tolerable. The other options describe activities that aren’t risk treatment—periodically replacing systems is maintenance, measuring risk without acting is assessment, and ignoring risk is not managing it.