← Home

IEC 62443-3-2 – Four Ts of Managing Risk

After risk assessment, the organisation must decide how to manage each risk that sits above tolerance. Teaching practice groups those decisions into four options — the Four Ts: Tolerate, Transfer, Terminate and Treat. The choice is always the asset owner’s, based on assessment results, policy and business context.

Part 3-2 does not use “Four Ts” as a normative clause title, but the same decisions appear when comparing unmitigated or residual risk with tolerable risk (ZCR 4 and ZCR 5) and when building the plan to address unacceptable risk. Recorded decisions feed the CRS and asset-owner approval.

Teaching note: Paraphrased for learning from IACS conceptual-design course material and related ISA/IEC 62443 risk-assessment practice. Not a verbatim extract of ISA publications or the standard — always refer to published text for normative wording.

Related: Develop a Plan | Mitigated Likelihood and Residual Risk | ZCR 5 | ZCR 4 | Five Ds of Treating Risk | Zone and Conduit Security Strategy | Balancing Security vs Cost


The Four Ts

T Meaning Typical use
Tolerate Accept the risk under policy without further reduction. Residual risk is within (or formally accepted above) tolerance; decision is documented and approved.
Transfer Shift financial or contractual exposure to another party. Insurance, contractual allocation to a supplier or integrator, or shared liability arrangements.
Terminate Remove the risk by stopping or changing the activity that creates it. Decommission a system or function, disconnect a risky interface, or redesign so the exposure no longer exists.
Treat Reduce likelihood and/or consequence with countermeasures. Additional technical, administrative or procedural controls — often structured with the Five Ds and sized to SL-T via Part 3-3.

How the Four Ts fit Part 3-2

Inside detailed assessment, when unmitigated or residual risk exceeds tolerance the team must decide whether to accept (tolerate), transfer or further mitigate (treat). Terminate is the option to eliminate the exposure entirely rather than live with or control it. Moving an asset into a higher-security zone can also change exposure by borrowing that zone’s countermeasures — a form of treat by redesign.

The plan to address unacceptable risk (Develop a Plan) evaluates existing controls, recommends additional ones, prioritises by relative risk, and weighs cost against effectiveness — then records which T was chosen for each significant risk.


Key takeaways