Mitigation strategies try to limit and control the impact
disruptive incidents and emergencies could have. They:

• Neutralize hazards.

• Remove or eliminate hazards.

• Reduce or limit the size of hazards.

• Control the rate at which hazards are released.

• Modify the nature of hazards to make them less threatening.

• Segregate hazards from vulnerable people and property.

• Use building construction standards to mitigate hazards.

• Follow rational land-use practices to avoid hazards.

• Protect information that could be exposed to hazards.

  • Protect proprietary information that could be at risk.

  • Protect competitive information that could be at risk.

• Protect structures that are exposed to hazards.

  • Relocate structures that are exposed to hazards.

  • Retrofit structures that are exposed to hazards.

  • Remove structures that are exposed to hazards.

• Use protective technologies to minimize exposure to hazards.

  • Use protective systems to minimize the exposure to hazards.

    • Use systems to minimize exposure to physical risks.

    • Use systems to minimize exposure to cyber risks.

  • Use protective equipment to minimize exposure to hazards.

    • Use equipment to minimize exposure to physical risks.

    • Use equipment to minimize exposure to cyber risks.

• Consider how each risk or hazard should be treated.

  • Consider whether or not you intend to accept the risk.

  • Consider whether or not you intend to avoid the risk.

  • Consider whether or not you intend to reduce the risk.

  • Consider whether or not you intend to transfer the risk.

    • Consider using insurance programs to transfer risk.

• Establish communication procedures to manage hazards.

• Have redundant resources available to address hazards.

  • Have redundant or backup personnel available.

  • Have redundant or backup systems available.

  • Have redundant or backup equipment available.

  • Have redundant or backup operations available.

  • Have redundant or backup materials available.

  • Have redundant or backup information available.

The above is based on NFPA 1600 2007 Annex A.5.5.1.

RELATED RESOURCES

NIST Cybersecurity Framework

How to Perform an Impact Analysis

How to Perform a Risk Assessment

Risk and Security Management Guide

How to Develop a Prevention Strategy

How to Write a Business Continuity Plan

ISO 45001 2018 Health and Safety Guide

ISO 31000 2018 Risk Management Guide

ISO 22301 2012 Business Continuity Guide

ISO 28000 2007 Supply Chain Security Guide

ISO 27001 and 27002 Information Security Guide

ISO 14971 Medical Device Risk Management Guide