02 — Capability · BC-130.30
Risk Response & Controls
Decide for each significant risk whether to avoid, reduce, transfer or accept it, and design the controls that make the chosen response real.
- Risk Treatment
- Risk Mitigation
- Control Design
In scope
- Risk response decisions and action plans
- Control design and the control library
- Risk acceptance with named owners
Out of scope
- Independent control testing (see BC-160)
- Security control operation (see BC-760)
Realized by · 1
Used in · 0
- Not yet placed on a value stream.
Build it · 0
- Nothing in the library points here yet.
Decomposes into · 4
- BC-130.30.10Risk Response PlanningChoose the treatment for each priority risk and assign the actions, owners and dates that carry it out.
- BC-130.30.20Control DesignSpecify preventive and detective controls that reduce a risk to within appetite, stated clearly enough to be tested.
- BC-130.30.30Control Library MaintenanceKeep one catalog of controls mapped to the risks they address, so a control is not designed twice or forgotten once.
- BC-130.30.40Risk AcceptanceRecord the decision to live with a risk, who made it, for how long and what would reopen it.