Information Security Handbook

Management choices when it comes to risk

When it comes to addressing risk, there is no simple answer. There are four ways that an organization can choose to respond to a newly discovered risk.

The organization can choose to do the following:

• Mitigate risk: Mitigation involves fixing the issue that is causing a vulnerability or implementing a compensating security control if the specific issue cannot be resolved.

For example, good patching is a key component of any well-functioning IT organization. If a missing patch causes a vulnerability, then you would patch the system to mitigate the vulnerability. However, there are often IT devices that must be on the enterprise network and cannot be regularly patched due to vendor limitations or compliance ...