Risk mitigation encompasses all measures that decrease risk exposure, including implementing controls, process redesigns, technology solutions, or behavior changes. Unlike risk avoidance (eliminating the activity), mitigation accepts some residual risk while reducing it to tolerable levels. Installing firewalls, encryption, and intrusion detection systems mitigates cyber risks without eliminating internet connectivity. Effective mitigation balances cost, operational impact, and risk reduction, selecting controls that provide the best return on risk-adjusted capital. Organizations prioritize mitigation investments based on risk assessments and treatment plans.