The four risk responses

Avoid

Stop the activity, or retire the asset, that creates the risk. If the thing isn't there, the risk isn't either. Avoidance makes sense when the activity isn't worth what it exposes you to.

Mitigate

Lower the likelihood or impact. The exercise splits mitigation into two choices, because they cost different things:

• Mitigate: remediate ("fix"): remove the vulnerability by patching, reconfiguring or replacing. This uses one of your limited remediation slots.
• Mitigate: compensating control ("reduce"): lower the likelihood or impact without removing the vulnerability, for example by segmenting, restricting access or monitoring.

Both are mitigation. "Fix" and "reduce" aren't separate responses.

Transfer (share)

Shift the financial impact to a third party, usually through insurance or a contract. Accountability, regulatory duties and reputational damage stay with your organization.

Accept

Make a documented, informed decision to keep the risk. The risk owner or senior management accepts it; security recommends. That's why the exercise asks who approves each acceptance:

• Security team
• IT operations (runs the system)
• Business owner of the affected asset or process
• Executive leadership / risk committee

Thinking like a manager

Risk is likelihood times impact for this organization. A CVSS score measures how severe a vulnerability is in general, not how much risk it creates for you. Weigh exposure, exploitation, the data involved, the controls already in place, and how much the fix costs.