GRC › Module 3 › Lesson 1
Treat Options
Risk treatment literacy names mitigate, transfer, accept, and avoid — map treatment choice to priority band on YOUR $GRC_LAB fictional risk before register updates.
Visual · t37_treat_options
Treat options literacy. $GRC_LAB only. Original Cyberlium.
Opening
Every High risk needs a decision — literacy teaches the four treatment options so fictional org scenarios on $GRC_LAB get explicit owner assignments.
Risk treatment options are mitigate — implement controls to reduce likelihood or impact; transfer — insurance or contractual shift; accept — documented approval within appetite; avoid — discontinue the activity causing risk. Each option needs owner, target residual level, and timeline on YOUR lab template. Cyberlium writes treatment row on YOUR $GRC_LAB — risk ID, option chosen, control summary, owner, target residual for one fictional scenario. Next: Risk Register.
1. Treatment options (named)
Mitigate: add control — MFA, encryption, monitoring — on YOUR fictional system. Transfer: cyber insurance or vendor contract language — literacy only on lab notes. Accept: formal sign-off when residual within appetite. Avoid: decommission risky lab feature or process.
On $GRC_LAB, write treatment row — risk ID, option, control or rationale, owner for one fictional risk.
Command guide
Try these commands — Treatment options (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
ISO 27001 treatment — https://www.iso.org/isoiec-27001-information-security.html NIST CSF — https://www.nist.gov/cyberframework ISACA — https://www.isaca.org/resources/glossary
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export GRC_LAB=${GRC_LAB:-$HOME/cyberlium-lab/t37-grc}
curl -sS https://www.iso.org/isoiec-27001-information-security.html | head -10
cat > "$GRC_LAB/notes/treatment-options-named.txt" <<'EOF'
Risk treatment options — NAMED LITERACY (ISO 27001 aligned):
Modify/Mitigate: implement controls to reduce likelihood or impact
Transfer: insurance, contractual liability shift (not absolve accountability)
Avoid: stop activity that creates risk (de-scope feature/vendor)
Accept: documented decision when residual risk within appetite
Always: residual risk + owner + review date in register
Lab: map each LAB-ORG-001 risk to one primary treatment in risk-register.csv
EOFCommand — copy this
grep -E 'Mitigate|Transfer|Accept|residual' "$GRC_LAB/notes/treatment-options-named.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: ISO 27001 treatment (https://www.iso.org/isoiec-27001-information-security.html); NIST CSF (https://www.nist.gov/cyberframework); ISACA (https://www.isaca.org/resources/glossary). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why explicit treatment beats silent acceptance
Undocumented acceptance fails audits — approver, date, and residual score required. Mitigation without owner stalls remediation. Treatment vocabulary aligns security and business on the same risk ID in registers.
Students assign lab treatments on notes — production treatment follows risk committee and change control.
3. Lab boundary
Forbidden: marking every risk Accepted without approver to skip work. Allowed: treatment options card — four options with $GRC_LAB fictional example.
Ship: treatment row for YOUR lab risk. Next: Risk Register.
4. What you ship: treatment row for $GRC_LAB
Risk ID, option, control, owner, target residual. $GRC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Treatment row. $GRC_LAB named. File t37-m03-l01-treat-options.txt chmod 600.
6. Wrong vs right: fraudulent certs vs YOUR lab templates
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Accept all High risks without approver. Choose mitigate with no control named.
Right
Write treatment row for YOUR $GRC_LAB fictional risk. Next: Risk Register.
Mission: assign treatment on YOUR lab risk
1) Pick mitigate, transfer, accept, or avoid. 2) Name control or acceptance rationale. 3) Assign owner and target residual. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Accept requires approver and date — silent acceptance fails audit sampling.
Knowledge Check
APPLY: Risk treatment options include:
Multiple choice
Knowledge Check
APPLY: True or False: Mitigate implements controls to reduce likelihood or impact.
True or False
Knowledge Check
APPLY: Treat options literacy on Cyberlium uses:
Multiple choice