Risk Treatment
The risk treatment decision is the last step of the Threat Analysis and Risk Assessment (TARA) under ISO/SAE 21434. For each threat scenario, you decide what happens to the risk, based on its risk value. The standard allows four options, which can also be combined:
- Avoid: the risk source is removed, or the activity is not started in the first place.
- Reduce: measures lower the risk.
- Share: the risk is transferred, for example through contracts or insurance.
- Retain: you carry the risk deliberately.
Every option has consequences
The decision does not finish the step. It determines which work product comes next.
Every decision to reduce leads to at least one cybersecurity goal. The goal says what must be protected, not how. The cybersecurity concept describes the how, with its cybersecurity controls.
Sharing always requires a cybersecurity claim. The risk does not go away; part of it just sits elsewhere.
Retaining is where the standard draws a finer line. A note in Clause 15 says that rationales for retaining and sharing are recorded as claims. The requirement in Clause 9 is narrower: retaining needs a claim only if it rests on assumptions made in the analysis.
Avoiding is the only option that changes the item itself. The standard refers to change management for this, and the TARA has to follow the change.
No threshold in the standard
The standard doesn’t say at what risk value a risk must be reduced. Elsewhere it only demands that no unreasonable risks remain, for example in vulnerability management and in validation. Where that line lies is up to the organization.
Annex H decides the same for both example scenarios: reduce. For spoofing the lamp request at “S: 5”, that surprises no one. For the denial of service at “O: 2”, it is less obvious. So a low risk value does not automatically mean you can retain the risk.
Risk treatment in practice
The verification in the concept phase checks whether the decisions are complete, correct and consistent with the analysis, and whether goals and claims fit the decisions. So the check is about relationships: scenario to decision, decision to goal or claim. In a spreadsheet, these are cross-references that someone maintains by hand.
And the decision comes back. For every vulnerability, the standard requires you either to assess and treat the risk again until no unreasonable risk remains, or to eliminate the vulnerability with an available patch. A risk retained at 2 may stand at 3 once an exploit is published. Our article on the TARA gives an overview of all steps.