C4.1 Seven responses, named decider

NIST IR 8286 [9]; NIST SP 800-39 [20]; COSO [2]

The first component requires that every risk in the register carry exactly one response from the list of seven, that doing nothing without saying so is not among them, and that the response be chosen by a named person after the alternatives have been compared on cost, effectiveness and feasibility. The register schema that the framework adopts in C6.1 makes the first part mechanical: a row without a response does not validate [9]. The second part comes from the security risk guidance, which is the only source in the set to say plainly that a response is a decision made by someone with authority, who develops the alternatives, weighs them on those three criteria and signs for what remains [20]. The governance framework supplies the breadth, since it is the source that insists the response be read against strategy and the portfolio of objectives rather than against the one row [2].

What this reconciles is the gap between a scoring exercise and a decision. Most registers I have seen are complete in the sense that every row has a word in the response column, and empty in the sense that nobody can say who chose the word or what else was considered. The component closes the gap with three fields that an auditor can test: the decider, the date and the alternatives. It also closes a gap on the positive side. The three opportunity responses change what an opportunity owner does, which is the test chapter 11 applied: an owner who may only accept or mitigate has no way to record a decision to pursue, and the register silently loses its upside.

Two details of the list deserve a sentence each. Share appears twice, once for a threat and once for an opportunity, because sharing a downside with an insurer or a partner and sharing an upside with a partner who brings capability are different decisions that happen to carry the same verb, and the register records which side of the row the sharing is on. And accept is a response, not an absence of one: it carries the same decider, date and rationale as the others, and in C4.5 it carries more, because an acceptance that leaves the measured exposure above appetite is the one response that must leave the layer and be heard by the governing body.