After risk assessment, the organisation must decide how to manage each risk that sits above tolerance. Teaching practice groups those decisions into four options — the Four Ts: Tolerate, Transfer, Terminate and Treat. The choice is always the asset owner’s, based on assessment results, policy and business context.
Part 3-2 does not use “Four Ts” as a normative clause title, but the same decisions appear when comparing unmitigated or residual risk with tolerable risk (ZCR 4 and ZCR 5) and when building the plan to address unacceptable risk. Recorded decisions feed the CRS and asset-owner approval.
Related: Develop a Plan | Mitigated Likelihood and Residual Risk | ZCR 5 | ZCR 4 | Five Ds of Treating Risk | Zone and Conduit Security Strategy | Balancing Security vs Cost
| T | Meaning | Typical use |
|---|---|---|
| Tolerate | Accept the risk under policy without further reduction. | Residual risk is within (or formally accepted above) tolerance; decision is documented and approved. |
| Transfer | Shift financial or contractual exposure to another party. | Insurance, contractual allocation to a supplier or integrator, or shared liability arrangements. |
| Terminate | Remove the risk by stopping or changing the activity that creates it. | Decommission a system or function, disconnect a risky interface, or redesign so the exposure no longer exists. |
| Treat | Reduce likelihood and/or consequence with countermeasures. | Additional technical, administrative or procedural controls — often structured with the Five Ds and sized to SL-T via Part 3-3. |
Inside detailed assessment, when unmitigated or residual risk exceeds tolerance the team must decide whether to accept (tolerate), transfer or further mitigate (treat). Terminate is the option to eliminate the exposure entirely rather than live with or control it. Moving an asset into a higher-security zone can also change exposure by borrowing that zone’s countermeasures — a form of treat by redesign.
The plan to address unacceptable risk (Develop a Plan) evaluates existing controls, recommends additional ones, prioritises by relative risk, and weighs cost against effectiveness — then records which T was chosen for each significant risk.