{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"security/risk-treatment","url":{"en":"https://atlas.maintz.dev/en/terms/security/risk-treatment/","da":"https://atlas.maintz.dev/da/terms/security/risk-treatment/"},"term":{"en":"Risk treatment","da":"Risikohåndtering"},"aka":{"en":["risk response"],"da":[]},"domain":["security"],"cluster":"risk-management","layer":"governance","status":"current","summary":{"en":"Choosing what to do about each risk - accept it, reduce it, share it with someone else, or avoid it altogether.","da":"Valget af, hvad man gør ved hver risiko - accepterer den, mindsker den, deler den med andre eller undgår den helt."},"body":{"formal":{"en":"The step in risk management where each assessed risk gets one of four responses - retained as it is, reduced with controls, shared with or transferred to another party, or avoided by stopping the activity - each with an owner and a plan.","da":"Trinnet i risikostyringen, hvor hver vurderet risiko får én af fire håndteringer - den accepteres, mindskes med kontroller, deles med eller overføres til en anden part eller undgås ved at stoppe aktiviteten - hver med en ejer og en plan."},"plain":{"en":"Like facing a leaky roof - you can live with it, patch it, buy insurance, or move out.","da":"Ligesom med et utæt tag - man kan leve med det, lappe det, tegne en forsikring eller flytte."},"inPractice":{"en":"A shipping company's board buys cyber insurance to share the cost of a ransomware attack, adds MFA to reduce the risk from stolen passwords, and accepts the small risk of an office printer failing.","da":"Bestyrelsen i et rederi tegner en cyberforsikring for at dele udgifterne ved et ransomware-angreb, indfører MFA for at mindske risikoen ved stjålne adgangskoder og accepterer den lille risiko for, at en kontorprinter svigter."},"whyItMatters":{"en":"Finding risks is pointless without a decision about each one, and that decision shows who owns it and what it costs.","da":"Det nytter ikke at finde risici uden en beslutning om hver enkelt, og den beslutning viser, hvem der ejer risikoen, og hvad den koster."}},"deepDive":{"en":"The familiar four options are a simplification. ISO 31000:2018 clause 6.5.2 lists seven: avoiding the risk by not starting or continuing the activity; taking or increasing the risk to pursue an opportunity; removing the risk source; changing the likelihood; changing the consequences; sharing the risk, for example through contracts or insurance; and retaining the risk by informed decision. NIST SP 800-39 uses five risk responses, separating sharing from transfer, while ISO/IEC 27005 has traditionally grouped the options as modification, retention, avoidance and sharing. The options are not mutually exclusive: a typical ransomware treatment combines mitigation (MFA, segmentation, offline backups), sharing (cyber insurance for the tail) and formal retention of what is left.\n\nISO/IEC 27001:2022 clause 6.1.3 turns treatment into a sequence of auditable steps: a) select treatment options in light of the assessment results; b) determine all controls necessary to implement them, from any source; c) compare those controls with Annex A to verify that nothing necessary has been omitted; d) produce the Statement of Applicability with justification for inclusions and exclusions; e) formulate a risk treatment plan; and f) obtain the risk owners' approval of the plan and their acceptance of the residual risks. Clause 8.3 then requires the plan to be implemented and its results retained.\n\nISO 31000:2018 clause 6.5.3 describes what a treatment plan should contain: the rationale for the chosen options including expected benefits, who is accountable for approving and implementing it, the proposed actions, resources, performance measures, constraints, required reporting and monitoring, and timing. In practice this means each treated risk is linked in the register to named actions, an owner, a deadline, a budget line and the expected residual rating, so that monitoring can later compare the expected with the achieved effect.\n\nSelection is a cost-benefit decision bounded by obligations. Legal and contractual requirements can rule options out entirely (a mandatory control cannot simply be retained away), stakeholder expectations and ethics count alongside expected-loss arithmetic, and ISO 31000 notes that treatment can introduce new risks and may not work as intended, so treatments must themselves be monitored. Treatment differs from incident response despite the similar-sounding synonym risk response: treatment decides in advance how a risk will be handled, whereas incident response deals with an event that has already occurred.","da":"De velkendte fire muligheder er en forenkling. ISO 31000:2018 punkt 6.5.2 nævner syv: at undgå risikoen ved ikke at starte eller fortsætte aktiviteten; at tage eller øge risikoen for at forfølge en mulighed; at fjerne risikokilden; at ændre sandsynligheden; at ændre konsekvenserne; at dele risikoen, fx via kontrakter eller forsikring; og at bibeholde risikoen ved en informeret beslutning. NIST SP 800-39 bruger fem risikoreaktioner og skelner mellem deling og overførsel, mens ISO/IEC 27005 traditionelt samler mulighederne som modifikation, bibeholdelse, undgåelse og deling. Mulighederne udelukker ikke hinanden: En typisk håndtering af ransomware kombinerer reduktion (MFA, segmentering, offline backup), deling (cyberforsikring til de største tab) og formel accept af det, der er tilbage.\n\nISO/IEC 27001:2022 punkt 6.1.3 gør håndteringen til en række trin, der kan auditeres: a) vælge håndteringsmuligheder ud fra vurderingens resultater; b) fastlægge alle de kontroller, der er nødvendige for at gennemføre dem, fra en hvilken som helst kilde; c) sammenholde kontrollerne med bilag A for at sikre, at intet nødvendigt er udeladt; d) udarbejde en Statement of Applicability med begrundelse for, hvad der er medtaget og udeladt; e) udforme en risikohåndteringsplan; og f) indhente risikoejernes godkendelse af planen og deres accept af de residuale risici. Punkt 8.3 kræver derefter, at planen gennemføres, og at resultaterne dokumenteres.\n\nISO 31000:2018 punkt 6.5.3 beskriver, hvad en håndteringsplan bør indeholde: begrundelsen for de valgte muligheder med de forventede gevinster, hvem der er ansvarlig for at godkende og gennemføre planen, de foreslåede handlinger, ressourcer, præstationsmål, begrænsninger, krav til rapportering og overvågning samt tidsplan. I praksis betyder det, at hver håndteret risiko i registret knyttes til navngivne handlinger, en ejer, en frist, en budgetpost og den forventede residuale vurdering, så overvågningen senere kan sammenligne den forventede med den opnåede effekt.\n\nValget er en cost-benefit-beslutning inden for rammerne af forpligtelser. Lov- og kontraktkrav kan udelukke muligheder helt (et obligatorisk krav kan ikke bare accepteres væk), interessenternes forventninger og etik tæller ved siden af regnestykket over forventet tab, og ISO 31000 påpeger, at håndtering kan skabe nye risici og måske ikke virker som tiltænkt, så håndteringerne selv skal overvåges. Risikohåndtering er ikke det samme som hændelseshåndtering, selv om det engelske synonym risk response lyder beslægtet: Risikohåndtering afgør på forhånd, hvordan en risiko skal håndteres, mens hændelseshåndtering tager sig af noget, der allerede er sket."},"howTo":{"steps":{"en":["Take the ranked risks from the assessment and, for each one above the acceptance level, decide with the risk owner whether to reduce, share, avoid or accept it.","For risks you reduce, choose the controls needed from any source and compare them with ISO 27001 Annex A so nothing necessary is missed.","Record in the Statement of Applicability which Annex A controls apply, why, and why any are excluded.","Write a risk treatment plan listing each action with owner, deadline, budget and the expected residual risk.","Have management approve the plan and the risk owners formally accept the residual risks, and keep the signed decision.","For shared risks, check that contracts, supplier terms or cyber insurance actually cover the scenario, and note what stays with you.","Implement the actions, track them in the risk register and report overdue items to management.","Reassess each treated risk after implementation to confirm the control works and the residual risk matches what was expected."],"da":["Tag de prioriterede risici fra vurderingen, og beslut sammen med risikoejeren for hver risiko over acceptniveauet, om den skal reduceres, deles, undgås eller accepteres.","Vælg de nødvendige kontroller til de risici, der skal reduceres, fra en hvilken som helst kilde, og sammenhold dem med ISO 27001 bilag A, så intet nødvendigt mangler.","Notér i Statement of Applicability (SoA), hvilke kontroller fra bilag A der gælder, hvorfor, og hvorfor eventuelle kontroller er fravalgt.","Udarbejd en risikohåndteringsplan, hvor hver handling har ejer, frist, budget og den forventede restrisiko.","Få ledelsen til at godkende planen og risikoejerne til formelt at acceptere restrisiciene, og gem den underskrevne beslutning.","Tjek ved delte risici, at kontrakter, leverandørvilkår eller cyberforsikring faktisk dækker scenariet, og notér, hvad der stadig ligger hos jer selv.","Gennemfør handlingerne, følg dem i risikoregistret, og rapportér forsinkede punkter til ledelsen.","Vurdér hver håndteret risiko igen efter gennemførelsen for at bekræfte, at kontrollen virker, og at restrisikoen svarer til det forventede."]},"pitfalls":{"en":["Accepting risks by default without a named owner with authority signing off.","Assuming cyber insurance removes the risk, when it only covers part of the financial loss.","Picking controls straight from Annex A without linking them to a specific risk.","Never checking whether the chosen controls actually reduced the risk."],"da":["At acceptere risici som standard, uden at en navngiven ejer med mandat skriver under.","At tro, at en cyberforsikring fjerner risikoen, når den kun dækker en del af det økonomiske tab.","At vælge kontroller direkte fra bilag A uden at koble dem til en konkret risiko.","Aldrig at tjekke, om de valgte kontroller faktisk har mindsket risikoen."]},"guides":[{"title":"Vejledning i risikostyring inden for informationssikkerhed (2025)","url":"https://www.sikkerdigital.dk/Media/639001951976452337/Vejledning%20i%20risikostyring%20inden%20for%20informationssikkerhed%202025.pdf","publisher":"Styrelsen for Samfundssikkerhed","tier":"official-doc","lang":"da"},{"title":"NIST SP 800-39 - Managing Information Security Risk","url":"https://csrc.nist.gov/pubs/sp/800/39/final","publisher":"NIST","tier":"standard"},{"title":"Risk management guidance","url":"https://www.ncsc.gov.uk/collection/risk-management","publisher":"NCSC UK","tier":"official-doc"}]},"edges":[{"type":"requires","to":"security/risk","confidence":"high","strength":"normal"},{"type":"requires","to":"security/control","confidence":"high","strength":"normal"},{"type":"requires","to":"security/risk-assessment","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/risk-management","confidence":"high","strength":"normal"},{"type":"causes","to":"security/residual-risk","confidence":"high","strength":"normal"}],"depth":5,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"ISO/IEC 27005:2022","tier":"standard"}],"draft":true}