In AC 10, the Mitigated risks are still appearing, while RA is done, with 'Include Mitigation Risk' option unchecked.

[Former Member]

The Mitigated risks are still appearing, while RA is done, with 'Include Mitigation Risk' option  unchecked.what is the possible reason?

[Former Member · Accepted solution]

Hi Plaban,

Kindly maitain the configuration parameter 1030 -Include Mitigated Risks as 'NO' under cofiguration setting in SPRO and then apply the note 1682738 at your end.

Regards,

Yukti

[Former Member]

Hi Plaban,

Have you mitigated the associated role or user and assigned the mitigating control to them?

Best Regards,

Smriti

[Former Member]

Hi Plaban,

It may be possible that you have mitigated the risk for the specific Rule id. or in other words while creating the Mitigation Control under the Access Risk you have mentioned some of the Action rule id or Permission rule id of the risk. Thats why when you run the risk analysis by unchecking the include mitigated risk, those rule ids appears which has not been included in the Mitigation Control.

Kindly check that what all the Risk Rule id are coming., and then check that mitigation control that whether that rule id is included in the mitigation control.

Regards

Shaily

[Former Member]

Hi Shaily,

i already checked that feature, and have even tried with * in Rule Id. But the risks still appear.