Chapter 16 — Security governance, risk and compliance: methods II
Lesson map
Lesson 16 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["16.1 Treatment options"]
N2["16.2 Residual risk"]
N3["16.3 Acceptance"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["16.1 Treatment options"]
N2["16.2 Residual risk"]
N3["16.3 Acceptance"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX046"]
[Learning outcomes]
|
v
[16.1 Treatment options]
|
v
[16.2 Residual risk]
|
v
[16.3 Acceptance]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) choose risk treatment options; (2) estimate residual risk after treatment; (3) document risk acceptance decisions.
16.1 Treatment options
Priya learns four treatment options: avoid the activity, reduce risk with controls, share risk through insurance or contracts, or accept it. For card skimming on the booking site, Riverton could avoid the risk by moving card payment to a hosted page run by its payment provider, removing card data from its own website entirely. For ransomware, it chooses to reduce risk with segmentation and backups and to share part of it through cyber insurance. Each choice depends on cost, effectiveness and the appetite agreed with management.
16.2 Residual risk
After choosing treatments, Priya estimates residual risk. With segmentation and tested backups, the ransomware scenario's expected cost falls because spread is limited and recovery is faster. Moving to a hosted payment page reduces the card skimming risk sharply, since card data no longer pass through Riverton's site. She records residual estimates next to the original ones so managers can see what each treatment achieves and whether remaining risk is within appetite. The card skimming estimate, for instance, should fall well below its original eleven thousand once card data leave Riverton's site.
16.3 Acceptance
Some risk remains. The managing director formally accepts the residual risk of lost laptops, because encryption makes data exposure unlikely and replacement costs are modest. Priya records the acceptance with the date, reasons, conditions and a review date. ISO/IEC 27001:2022 expects risk owners to approve treatment plans and accept residual risks. She learns that formal acceptance makes decisions accountable and prevents risks from being silently ignored. Mr. Lind asks what would change the decision, and Priya records the condition that unencrypted laptops found later would reopen it.
Worked example
Priya applies four treatment options, estimates residual risk after segmentation and a hosted payment page and records formal acceptance for laptops.
Synthetic case. Treatments and estimates are synthetic; ISO/IEC 27001:2022 is real.
Errors and limits
Residual estimates are uncertain. Insurance terms limit cover.
Exercises
- EX046 — Avoidance example. How can Riverton avoid the card skimming risk? Rubric: 3 = move card payment to a hosted page;; 2 = hosted page;; 1 = vague;; 0 = none.
- EX047 — Residual purpose. Why record residual next to original estimates? Rubric: 3 = to show what treatments achieve against appetite;; 2 = comparison;; 1 = vague;; 0 = none.
- EX048 — Accepted risk. Which residual risk did the managing director accept? Rubric: 3 = lost laptops;; 2 = laptops;; 1 = ransomware;; 0 = none.
Synthesis
Treatment choices, residual estimates and formal acceptance complete the risk process.
Continue studying — chapter 16 of 30
← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →