---

id: "RA-07" title: "Risk Response" family: "RA" family_name: "Risk Assessment" sort_id: "ra-07" priority: "P1" implementation_level: "organization"

---

Statement

Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.

Guidance

Organizations have many options for responding to risk including mitigating risk by implementing new controls or strengthening existing controls, accepting risk with appropriate justification or rationale, sharing or transferring risk, or avoiding risk. The risk tolerance of the organization influences risk response decisions and actions. Risk response addresses the need to determine an appropriate response to risk before generating a plan of action and milestones entry. For example, the response may be to accept risk or reject risk, or it may be possible to mitigate the risk immediately so that a plan of action and milestones entry is not needed. However, if the risk response is to mitigate the risk, and the mitigation cannot be completed immediately, a plan of action and milestones entry is generated.

Assessment Objective: findings from security assessments are responded to in accordance with organizational risk tolerance;

Assessment Objective: findings from privacy assessments are responded to in accordance with organizational risk tolerance;

Assessment Objective: findings from monitoring are responded to in accordance with organizational risk tolerance;

Assessment Objective: findings from audits are responded to in accordance with organizational risk tolerance.

Risk assessment policy

assessment reports

audit records/event logs

system security plan

privacy plan

other relevant documents or records

Organizational personnel with assessment and auditing responsibilities

system/network administrators

organizational personnel with security and privacy responsibilities

Organizational processes for assessments and audits

mechanisms/tools supporting and/or implementing assessments and auditing