CRISC: Certified in Risk and Information Systems Control

The risk owner is accountable for a specific risk and for deciding its treatment, including whether and how to mitigate it. NIST guidance likewise describes the risk owner as evaluating whether residual risk can be reduced to an acceptable level through additional security controls.