Risk treatment options: reduce, avoid, share or accept

Once a risk is rated you pick a response: reduce it with controls, avoid it by stopping the activity, share it with another party, or accept it knowingly. NIST also lists transfer, and its IR 8286B adds terms such as conditioning and optimization. The right choice depends on cost, tolerance and who owns the outcome.

The options

• Reduce (mitigate). Add or improve controls to lower likelihood or impact. This is the most common choice. Example: enforce phishing resistant sign in for administrators.
• Avoid. Stop the activity that creates the risk. Example: do not store a data type you do not need.
• Share or transfer. Move part of the financial effect to another party through insurance or a contract. Example: cyber insurance, or a supplier agreement that assigns liability.
• Accept. Decide to live with the risk, usually because the cost of treatment exceeds the expected loss or because it falls within tolerance.

NIST SP 800-30 lists the responses as acceptance, avoidance, mitigation, sharing and transfer. NIST IR 8286B lists avoidance, acceptance, mitigation, sharing, transfer, conditioning and optimization.

How to choose

1. Compare with tolerance. If the current rating is inside your stated appetite, acceptance may be fine.
2. Compare costs. What does the control cost against the loss it avoids? A rough range is enough.
3. Check feasibility. Can you do it this quarter, with the people you have?
4. Consider combinations. Most real plans mix reduce and share.

What sharing does not do

Insurance and contracts can move money, not the event. A breach still disrupts operations and damages trust, and a policy may have exclusions or conditions. Read terms carefully, and do not log a risk as treated just because a policy exists.

What acceptance requires

Accepting a risk is a decision, not a default. Record:

• The risk and its rating at the time.
• Why acceptance was chosen.
• Who accepted it, with authority to do so.
• The date, and when it will be reviewed.

If nobody can be named, you have neglect, not acceptance.

After the decision

Update the register with the response, actions and dates, then re-rate the risk after the controls are in place. The difference is your residual risk, covered in a separate post. NIST IR 8286B describes adding risk priorities and response information to the risk register, which then supports an enterprise wide view of costs and choices.

A common mistake

Teams often choose "reduce" for everything because it feels active. Ask whether avoiding the activity is cheaper, such as retiring an unused integration, and whether acceptance is honest for low rated items. Spending effort where it changes the outcome is the whole point of choosing a response.

Quick check

Sources

• NIST SP 800-30 Rev. 1
• NIST IR 8286B, Prioritizing Cybersecurity Risk for Enterprise Risk Management

Last reviewed: 19 October 2026.