Risk treatment

Abstract

Risk treatment involves deciding on strategies and controls to deal with cyber-risks, and starts with identification of treatments for selected risks. After identifying treatments we assess their effect and consider whether the residual risk is acceptable. If it is, the documentation is finalized and the process terminates, otherwise we need to go back and do another iteration of the treatment identification. This chapter concludes the running example by demonstrating the risk treatment step based on the risk evaluation results from Chap. 9.