ACP 122 (F) - Multilateral Planners Conference

UNCLASSIFIED
ACP 122(F)
a. Tolerate - acknowledge liability for the costs if the risk should be realized,
b. Terminate - abandon the activity or function which causes the risk,
c. Transfer - make it another agency’s responsibility, e.g., an outsourcing partner or
an insurance company, and
d. Treat - implement counter-measures to limit the likelihood and/or impact of the
risk.
METHODOLOGY
310. Rather than developing a unique common methodology for risk management, national
standards will be adopted for risk management in combined operations. This approach facilitates
the nations' compliance with standards, and promotes enforcement of standards. For combined
systems, the relevant Designated Approval Authority(s) (DAA) will make the decision regarding
what constitutes an acceptable risk.
COUNTER-MEASURES
311. Those risks that cannot be accepted, transferred or avoided must be reduced by countermeasures.
There are many types of counter-measure, which operate in one of the following
arenas:
a. Physical (e.g., a perimeter fence),
b. Procedural (e.g., having an authorisation form signed by an appropriate person
before a new user account is set up),
c. Personnel (e.g., security clearances required for system administrators and users,
user training), and
d. Technical (e.g., use of an evaluated password mechanism).
312. Counter-measures are an actual cost, set against the potentially greater cost of the
realized risk. That actual cost might be financial (e.g., the purchase, maintenance and licensing
cost of a software package, or the personnel costs of an increased security force) or operational
(e.g., slowing down information exchange between combatants by imposing a ‘second authorised
signature’ rule for information release). The costs must be identified and recorded if properly
informed risk management decisions are to be made.
3-3 Original
UNCLASSIFIED