Finding a risk is half the job. RA-7 Risk Response is the other half: deciding what to do about each finding. NIST 800-53 binds US federal systems and, by contract, other organizations. For everyone else it is a reference, and it describes the discipline auditors want to see behind a findings list.
What it means in practice
The statement is one sentence. Respond to findings from security and privacy assessments, monitoring and audits in accordance with your risk tolerance.
The guidance names the options. You can mitigate by adding or strengthening controls. You can accept the risk with a justification. You can share or transfer it, for example through insurance or a contract. Or you can avoid it by changing what you do. The guidance says your risk tolerance shapes the choice, and that you should decide on a response before you generate a plan of action and milestones entry. Sometimes a risk can be mitigated right away, so no entry is needed.
The key word is findings. They come from penetration tests, scans, audits, internal reviews and incidents. All of them need a recorded response.
Evidence to collect
- A statement of risk tolerance, such as the highest residual risk the business accepts without executive sign off.
- A log of findings with the response chosen for each, the rationale and the owner.
- Risk acceptance records with an expiry date and an approver at the right level.
- Plans and milestones for mitigations, and proof of completion.
- Evidence that accepted risks were reviewed at expiry.
Common gaps
- Findings sit in a report with no response recorded.
- Risks are accepted by the engineer who owns the system, not by someone with the authority to accept them.
- Acceptances never expire.
- Risk tolerance is undefined, so every decision is ad hoc.
How to implement it
Write down what level of risk each role may accept. Add a required field to your findings tracker: response, reason, owner, due date. For accepted risks add an expiry, usually six or twelve months. Review the log in a standing meeting.
Quick check
Is accepting a risk a failure?
No. It is a valid response when it is justified, approved by the right person and reviewed on a schedule. Silent acceptance by neglect is the failure.
What does sharing a risk mean?
Moving part of the impact to another party, for example through cyber insurance or a contract term. The risk is reduced for you, not removed.
