Skip to main content

​
Values

IDLabelSort OrderDescription
avoidingAvoiding0Eliminates the risk entirely by removing the threat source or vulnerability. No residual risk remains. Highest-effort but most complete mitigation.
reducingReducing1Applies security controls to lower the risk to an acceptable level. The risk still exists but is mitigated within tolerance. Most common treatment in practice.
sharingSharing2Transfers or shares risk responsibility with another party (e.g., supplier, customer, insurer) via contractual agreement. Risk is not eliminated but ownership is redistributed.
retainingRetaining3Accepts the residual risk after an informed decision. No additional controls are applied. Requires explicit sign-off and documented justification.

​
Treatment Validation Rules

The Risksheet enforces completeness requirements based on the selected treatment choice through two cell decorators:
Treatment ChoiceRequired ActionEnforced ByWarning Text
avoidingLink a Cybersecurity GoalgoalHighlight decorator”Goal required”
reducingLink a Cybersecurity GoalgoalHighlight decorator”Goal required”
sharingEnter a justification in taraClaimsclaimHighlight decorator”Claim required”
retainingEnter a justification in taraClaimsclaimHighlight decorator”Claim required”
When the required action is not completed, the respective cell displays an orange outline with the .treatmentMissing CSS class and a .missing-hint text overlay.

​
Field Binding

PropertyValue
Field IDtreatmentChoice
Work Item TypetaraRecord
Enum IDtaraRecord-treatmentChoice
Field TypeEnum (single-select)
The treatmentChoice field is a custom field on the TARA Record work item type.

​
Risksheet Usage

The treatmentChoice column in the Risksheet Configuration:
  • Uses the taraRecord-treatmentChoice enum for value selection
  • Participates in the goalHighlight and claimHighlight decorator logic to enforce ISO/SAE 21434 treatment completeness
  • Appears in the following views:
    • Overview
    • 4. Risk Treatment

​
ISO/SAE 21434 Alignment

The four treatment options correspond to ISO/SAE 21434 Table 9 risk treatment strategies:
Enum ValueISO/SAE 21434 StrategyClause Reference
avoidingRisk AvoidanceClause 15.5
reducingRisk ReductionClause 15.5
sharingRisk SharingClause 5.4
retainingRisk RetentionClause 15.5

​
Lucene Queries

type:taraRecord AND treatmentChoice:reducing
type:taraRecord AND treatmentChoice:retaining
type:taraRecord AND treatmentChoice:avoiding
type:taraRecord AND treatmentChoice:sharing

​
Configuration Notes

  • Sort order (0-3) maps from the most complete risk elimination (avoiding) to passive acceptance (retaining), reflecting a descending preference for risk elimination completeness.
  • No none or pending value exists. The field is empty until the analyst makes a treatment decision, which may be enforced as a workflow requirement before document approval.
  • When reducing is selected, the analyst should also link Risk Control work items via the task column in the Risksheet. The risk control is connected to the TARA Record through the mitigates link role.
  • When retaining is selected, ISO/SAE 21434 requires documented justification. The taraClaims field captures this justification, and the claimHighlight decorator enforces its presence.