1. Avoidance: all risk is by-passed by deciding not to process, store or maintain the information [or other asset]
2. Transfer of assets outside the risk area: Assets at risk are moved outside the risk boundary.
3. Reduction of threat: Mechanism(s) put in place to reduce threat.
4. Reduction of vulnerability: Mechanism(s) put in place to reduce vulnerability.
5. Reduction of criticality or mission impact: Alter process(es) to minimize risk.
6. Detection: Analysis of logs, audit trails, intrusion detection systems, etc.