Guidance: choosing treatment options balances the benefits for the objectives against the cost, effort and disadvantages of implementing them. Options are not mutually exclusive and not all fit every situation; they include avoiding the risk by not starting or continuing the activity, taking or increasing the risk in pursuit of an opportunity, taking away the source of the risk, altering its likelihood or its consequences, sharing it through contracts or by buying insurance, and deciding, on an informed basis, to keep the risk. Justifying a treatment goes beyond economics and should take in what the organization is obliged to do, what it has chosen to commit to and what stakeholders think; selection should follow the objectives, the risk criteria and the available resources, and should consider stakeholders' values, perceptions and possible involvement and how to communicate and consult with them, since equally effective treatments can be more or less acceptable to different stakeholders. Treatments can fail to produce the expected outcome or produce unintended ones, so monitoring and review must be part of implementation, and treatment can create new risks that need managing. Where no option exists or the options do not modify the risk enough, the risk should be written down and reviewed on an ongoing basis. Decision makers and stakeholders should know what residual risk is left and how large it is, which should be documented, monitored, reviewed and treated further where appropriate.
This control maps to 3 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.