Risk Treatment Decisions
Key Takeaways
Treatment is the decision step in the risk management processes named in subdomain 1.2.
The decision should match the risk to the business need and the organization's policy.
Document the decision and who approved it.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 1.2, checked 2026-10-22.
Treatment Is a Decision
After a risk is assessed, the organization decides how to respond. The outline names risk management processes but does not list named treatment categories, so treat the decision as a process step: the choice should fit the risk, the business need, and the organization's policy, and it should be recorded with an accountable owner.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 1.2, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Checking the Decision
A good answer to a treatment scenario names the risk, the decision, and the owner. If the decision removes the data that created the risk, it addresses the risk at its source. If the decision accepts a risk, the scenario should show who accepted it and that the acceptance is documented. Decisions that skip the owner or the documentation are weaker answers.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 1.2: Risk management lifecycle
- 1.2: Risk management processes
Common Traps
A common trap is treating a risk decision as finished once it is written. The lifecycle continues: a decision must still be monitored, and a risk that changes needs a new assessment.
Which element is essential when a risk decision is recorded?
The accountable owner of the decision
The name of the vendor who sold the tool
The color of the risk report
The number of pages in the policy
Sections you finish are checked off in the contents.