{"version":"0.2.0","built_at":"2026-10-10T20:58:14.188Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","capability":{"id":"BC-130.30","name":"Risk Response & Controls","level":2,"parent_id":"BC-130","l1_id":"BC-130","industry":"cross-industry","macro_id":"MC-10","path":["Enterprise Risk","Risk Response & Controls"],"description":"Decide for each significant risk whether to avoid, reduce, transfer or accept it, and design the controls that make the chosen response real.","aliases":["Risk Treatment","Risk Mitigation","Control Design"],"in_scope":["Risk response decisions and action plans","Control design and the control library","Risk acceptance with named owners"],"out_of_scope":["Independent control testing (see BC-160)","Security control operation (see BC-760)"],"csdm_note":null,"status":"active","successor_id":null,"child_ids":["BC-130.30.10","BC-130.30.20","BC-130.30.30","BC-130.30.40"]},"crosswalk":{"realized_by":[{"product_id":"PR-100","product":"ServiceNow","pc_id":"PC-100.80","pc":"Governance, Risk and Compliance","maturity":"partial","via":null}],"used_in":[],"patterns":[],"stacks":[],"books":[]},"ancestors":[{"id":"BC-130","name":"Enterprise Risk","level":1}],"children":[{"id":"BC-130.30.10","name":"Risk Response Planning","level":3,"child_count":0},{"id":"BC-130.30.20","name":"Control Design","level":3,"child_count":0},{"id":"BC-130.30.30","name":"Control Library Maintenance","level":3,"child_count":0},{"id":"BC-130.30.40","name":"Risk Acceptance","level":3,"child_count":0}]}