Mitigation applies actions that reduce the likelihood or effects of an identified cybersecurity risk. It does not promise to eliminate risk. Start with what could be harmed, how serious the exposure is, and which actions would make a meaningful difference; use that assessment to direct limited resources toward the highest concerns. section 8.1.3 section 1.2
Choose a response that fits the risk and the organization’s tolerance for it:
- Mitigate by patching vulnerabilities, strengthening configurations, training employees, updating policies, or improving incident response and backup readiness. section 8.1.3
- Accept a risk when action would cost more than its expected benefit or the risk is within tolerance; monitor it so that decision remains valid. section 5.3.1
- Avoid the risk by discontinuing or changing the activity that creates it, or transfer some financial effect through insurance or outsourcing. section 5.3.1
- Improve detection and response when preventing every incident is unrealistic; finding and containing an incident sooner can limit damage. section 5.3.1
Measure the result, then inspect what remains
After a breach involving patient information, a healthcare company sets targets to resolve 85% of identified risks, address 90%, and resolve 95% within its target time to resolve. Its later dashboard shows 75% resolved, 80% addressed, and 90% resolved within the target time. Each measure has improved, but each misses its stated target. The immediate decision is not simply to celebrate the percentages: examine the unresolved risks for severe threats and investigate delays or dependencies before assigning the next mitigation work. section 5.3.3
Figure 5.6 The left side is an example of a risk management dashboard for MedPharma Inc. at the time of the breach several years ago. The risk register will contain the details of the risks. Tracking metrics helps depict the story of how well the organization is doing to reduce risk. The right is the risk management dashboard after focusing on reducing cybersecurity risks.
Compare the dashboards from the breach and after the risk-reduction effort. Use the risk register for details that the summary percentages cannot show, especially the severity of unresolved risks. section 5.3.3
Match actions to the evidence. For example, patch critical and high vulnerabilities, coordinate updates with vendors, add automated monitoring, train responders, and review the metrics regularly. Falling vulnerability counts and faster detection or containment indicate progress; remaining high vulnerabilities still call for prioritized action. Report both gains and unfinished work so leaders can allocate resources accordingly. section 6.3.3 section 1.2
