As the second element of the overall PoF measurement, mitigation is anything that prevents or lessens the exposure from reaching the component.
PMM is an acronym common in US regulatory discussions that essentially means mitigation measures used in risk management. Most mitigation efforts should be directed towards minimizing probability of failure but there are certainly also opportunities to reduce consequence potential. See also PoF vs CoF–Where Should the Focus Be?, full article.
Mitigation of consequence potential is best handled as a discussion independent from this PoF discussion.
Mitigation estimates are additive (OR gate), reflecting the real-world cumulative benefits, as well as diminishing returns, associated with multiple layers of protection.
Selection of appropriate mitigation measures involves decision-making around risk management. Concepts of acceptable risk, ALARP, and cost-benefit analyses feature prominently in such decision-making.
