Risk treatment step Sample Clauses

Risk treatment step. In this step of the SRMM, the list of prioritised risk elements is analysed, considering the risk evaluation criteria. For each risk element, an assessment must be made to either: • Reduce the risk - appropriate security controls will have to be selected that reduce the risk. A residual risk might still be present, even with the selected security controls im- plemented, but it will be lower than the original risk. • Accept the risk - the risk as-is being accepted entirely. • Transfer the risk - Transferring risk can be done by, e.g., insurance against the conse- quences of a risk, or by sub-contracting a partner that will take over part of the respon- sibility. • Avoid the risk - the risk can be avoided by, e.g., changing the intended use of function- ality or context of the original planned activities. In the risk reduction methodology, we will focus on the first bullet above: reduce the risk by implementing security controls. When risk is transferred or avoided, there will also be a risk reduction and resulting residual risk. Risk transfer or risk avoidance may incur costs; these are out of scope of this activity. As part of the risk reduction activity, a gap analysis will be performed on security controls and technical measures to determine which controls and technical measures are needed to reduce risk but are missing or not available today. For these missing controls, a cost assessment must be conducted, and the risk reduction must be calculated. These steps are all recorded in the risk treatment plan.