Which term best describes the management of risk through countermeasures and controls to reduce probability or impact?

Which term best describes the management of risk through countermeasures and controls to reduce probability or impact?

• A. Risk acceptance
• B. Risk sharing
• C. Risk transfer
• D. Risk mitigation

Answer: (D)

Risk mitigation means reducing the probability that a risk will occur or diminishing the impact if it does happen by implementing countermeasures and controls. This is done through actions like applying security patches, enforcing strong access controls, deploying encryption, performing regular backups, establishing incident response and disaster recovery plans, and ongoing monitoring. By putting these safeguards in place, you actively lower the chance of a threat succeeding or limit the damage it can cause, which is exactly what managing risk through controls aims to achieve. Other approaches—accepting risk without action, sharing risk with others, or transferring risk to another party—do not focus on reducing the inherent risk through protective measures in the same way. Acceptance involves no preventative steps, sharing distributes the risk among participants, and transfer shifts the risk burden to someone else, whereas mitigation directly reduces risk exposure through concrete controls.

Risk mitigation means reducing the probability that a risk will occur or diminishing the impact if it does happen by implementing countermeasures and controls. This is done through actions like applying security patches, enforcing strong access controls, deploying encryption, performing regular backups, establishing incident response and disaster recovery plans, and ongoing monitoring. By putting these safeguards in place, you actively lower the chance of a threat succeeding or limit the damage it can cause, which is exactly what managing risk through controls aims to achieve.

Other approaches—accepting risk without action, sharing risk with others, or transferring risk to another party—do not focus on reducing the inherent risk through protective measures in the same way. Acceptance involves no preventative steps, sharing distributes the risk among participants, and transfer shifts the risk burden to someone else, whereas mitigation directly reduces risk exposure through concrete controls.