DataTerminology.comNEW
Actions that reduce the likelihood or impact of risks by implementing controls, safeguards, or design changes.
DESCRIPTION
Mitigation is a core risk treatment strategy focused on reducing probability or impact. It includes preventive controls, detection mechanisms, and design changes that lower exposure. Security teams mitigate threats through segmentation, encryption, monitoring, and hardening. In AI, mitigation addresses model risks like bias, drift, and misuse with governance, testing, and guardrails. Effective mitigation is prioritized by risk levels and validated through testing and continuous monitoring.
ALTERNATIVE DEFINITIONS
NIST CSRC
Prioritizing, evaluating, and implementing the appropriate risk-reducing controls/countermeasures to eliminate vulnerabilities.
Describes mitigation as targeted risk-reducing control implementation.
Project Management Institute
Mitigation is a risk response strategy whereby the project team acts to reduce the probability of occurrence or impact of a risk.
Defines mitigation within project risk response strategies.
ISO 31000
Risk treatment involves selecting and implementing measures to modify risk.
Places mitigation under the broader concept of risk treatment.
RELATED TERMS
Risk Management Control Remediation Compensating Controls Threat Modeling Vulnerability Management Safeguards Incident Response Containment Prevention
COMPETING TERMS
Risk Acceptance Risk Avoidance Risk Transfer
RELATIONS
- Narrower: Bias Mitigation
KNOWLEDGE AREAS
Data Security AI Governance Data Privacy & Compliance Data Management
TARGET AUDIENCE
Chief Information Security Officer Security Architect Data Privacy Officer IT Manager Data Governance Manager MLOps Engineer
EXTERNAL SOURCES
- Wikipedia - Risk management#Risk treatment
- NIST - NIST glossary definition
- PMI - Project risk mitigation strategies
- ISO - Risk treatment framework
TOP QUESTIONS
How do teams prioritize Mitigation actions?
They use risk scoring, impact/probability matrices, and business criticality. Highest risks with feasible controls are addressed first.
Category: Management
What is the biggest misunderstanding about Mitigation?
Some view it as complete risk elimination; in reality, mitigation reduces risk but residual risk remains and must be monitored.
Category: Misunderstanding
What are common Mitigation techniques in data security?
Encryption, access controls, segmentation, patching, and monitoring. Defense-in-depth combines multiple mitigations for resilience.
Category: Overview
How does Mitigation apply to AI systems?
Mitigate bias, drift, and misuse via governance, testing, guardrails, and human oversight throughout the ML lifecycle.
Category: Application
What risks accompany Mitigation efforts?
Operational overhead, performance trade-offs, and potential complexity. Misconfiguration can introduce new vulnerabilities.
Category: Risk
How is Mitigation effectiveness validated?
Through testing, red teaming, audits, and continuous monitoring with metrics and alerts to ensure controls function as intended.
Category: Validation
What are alternatives to Mitigation in risk treatment?
Risk acceptance, avoidance, or transfer via insurance or contracts. Choice depends on context and cost-benefit analysis.
Category: Alternatives
How should teams document Mitigation?
Maintain risk registers, control mappings, and evidence of implementation. Regularly review and update artifacts for auditability.
Category: Collaboration
What is required to plan Mitigation well?
Clear risk identification, feasible control selection, stakeholder buy-in, implementation plans, and defined metrics for success.
Category: Requirements