Develop and implement risk mitigation plans.

When the consequences of risk are determined to be unacceptable, you must act to address it. Addressing risk requires the development of a plan. Risk response will require adjustments to your current security strategies. Not all risk can be mitigated. You need to address residual risk—the risk that remains and is accepted by the organization after response plans are implemented.

Determine how you will deal with the risks identified in your risk assessment report. Create a plan specifying how you will address the risks. Options include risk avoidance, acceptance, monitoring, transfer, and mitigation. Determine the actions you will take to limit risk, security controls you plan to put in place, and the resources needed to implement the plan.