[ISO/IEC 27005:2008] Risk treatment [BS 7799-3:2006] Risk treatment and management decision making [SP 800-30] Risk mitigation [Risk IT] 
RE 2.3 Identify risk response options RR2.3 Respond to discovered risk exposure and opportunity