EBIOS RM Workshop 5—Risk Treatment

1Cadre de l'atelier

Objective	Define a risk-treatment strategy and identify residual risks.
Inputs	Security baseline (Workshop 1); ecosystem security measures and strategic scenarios (Workshop 3); operational scenarios (Workshop 4).
Participants	Management, business teams, CISO, and IT management.
Sorties	Risk-treatment strategy, continuous security improvement plan (CSIP), residual-risk summary, and risk-monitoring framework.

This workshop comprises five activities: 5-1 summarise risk scenarios, 5-2 decide on the treatment strategy, 5-3 define measures in the CSIP, 5-4 assess residual risks, 5-5 establish the monitoring framework.

2How a risk is built

A risk scenario (ISO 27005:2022: a sequence or combination of events leading from the initial cause to an undesirable consequence) is built from the components produced in previous workshops:

The most relevant targeted objectives (W2) are linked to the most severe feared events (W1) to build strategic scenarios (W3) and then their operational implementation (W4), producing the final risk.

3Treatment options

For every risk positioned in the severity × likelihood matrix, Activity 5.2 selects one of four strategies:

↓ Risk reduction

Implement security measures to reduce severity and/or likelihood—the preferred option under ISO 27005:2022.

⛔ Risk avoidance

Stop the activity or project creating the exposure when the risk is unacceptable and cannot be controlled.

↔ Risk transfer

Share the risk with a third party through cyber insurance or contracted outsourcing with security obligations.

✓ Maintien (acceptation)

Knowingly accept the risk through a formal, documented decision approved by the designated owner.

Common mistake: failing to approve risk acceptance. Retaining a risk must be an explicit decision by its owner, not a silent omission from the treatment plan.

4The CSIP — continuous security improvement plan

The security measures selected across all workshops—baseline gaps, ecosystem measures, and supporting-asset measures—are organised in the CSIP across four areas:

🧭Gouvernance & anticipation
Risk governance, accreditation, and threat/vulnerability intelligence

🛡Protection
Segmentation, authentication, encryption, and physical security

🚨Defence
Monitoring, detection, and incident response

🔄Resilience
Backup, business continuity and recovery, and crisis management

Each CSIP measure documents related risks, owner, implementation obstacles, cost and complexity, deadline, and status.

5Residual risk and monitoring

The residual risk is the risk scenario remaining after the selected treatment strategy is applied. Security measures generally reduce only likelihood —not severity, which depends on the business value itself.

Produce a one-year residual-risk map, at the CSIP's latest deadline, to show decision-makers that some risks will remain uncovered in the meantime.

Le suivi s'organise via un information-security steering committee meeting periodically (quarterly or half-yearly), CSIP measure progress, and previously approved indicators. Operational triggers—supporting-asset change, incident, new vulnerability—or strategic triggers—scope or organisational change—start another analysis iteration.