Mitigation is defined as:

Mitigation is defined as:

• A. The degree to which the organization reduces risk
• B. Actions to escalate risk
• C. The inherent risk without controls
• D. Residual risk after controls

Answer: (C)

Mitigation focuses on actions taken to lower risk. It describes how much risk the organization reduces through controls, policies, and safeguards, moving risk from its higher inherent level to a lower residual level after those measures are in place. For example, encryption and strong access controls reduce both the likelihood and impact of a breach, thereby reducing overall risk. This is different from inherent risk (the risk present before any controls) and residual risk (the risk that remains after controls are applied). So the description that best fits mitigation is the degree to which the organization reduces risk.

Mitigation focuses on actions taken to lower risk. It describes how much risk the organization reduces through controls, policies, and safeguards, moving risk from its higher inherent level to a lower residual level after those measures are in place. For example, encryption and strong access controls reduce both the likelihood and impact of a breach, thereby reducing overall risk. This is different from inherent risk (the risk present before any controls) and residual risk (the risk that remains after controls are applied). So the description that best fits mitigation is the degree to which the organization reduces risk.