Domain 2: Information Security Risk Management
Finding and sizing information risk, from threats and vulnerabilities to analysis, then treating, owning, monitoring and reporting it.
Revising? All of this domain's slides in one deck. When you're done, take the domain quiz.
Risk foundations
- Risk Management Concepts and Frameworks What information risk is, the life cycle for managing it, and the frameworks (ISO 31000, ISO 27005, NIST, FAIR, COSO, Risk IT) a security manager draws on.
- Inherent Risk, Residual Risk, Appetite and Tolerance The yardsticks of risk management: risk before and after controls, how much risk the organisation is willing and able to take, and how the security manager uses them to make decisions.
Threats and vulnerabilities
- Threat Actors, Motivations and Attack Vectors Who attacks organisations and why, the most common ways in, and how understanding attackers helps the security manager assess risk realistically.
- The Evolving Threat Landscape: AI, Cloud and Supply Chain The emerging risks a security manager watches today (AI, cloud, supply chain, extortion, operational technology, quantum) and a disciplined way to respond when something new appears.
- Threat Modelling and Cyber Threat Intelligence Two ways to understand threats: threat modelling looks at a system's design from the attacker's view; cyber threat intelligence tells you what attackers are actually doing.
- Vulnerability Assessment and Scanning How the security manager runs a vulnerability assessment program: finding technical and non-technical weaknesses, scanning methods, and prioritising fixes by risk rather than by score.
- Control Deficiencies and Security Gap Analysis How to find where controls are missing, badly designed or not working, compare the current state with a benchmark, and turn gaps into prioritised, root-cause fixes.
Risk analysis
- The Risk Assessment Process The steps of an information security risk assessment, who should take part, how often it's done and what it produces for the security manager and the business.
- Qualitative Risk Analysis: Likelihood and Impact How qualitative and semi-quantitative analysis rate risks with scales and heat maps, what makes the scales reliable, and where the method falls short.
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation How to put a money value on risk with SLE and ALE, how models such as FAIR improve the estimates, and when quantitative analysis is worth the effort.
- Risk Scenarios and Prioritisation How to describe risks as concrete scenarios the business recognises, build them top-down and bottom-up, and prioritise them for treatment.
Risk treatment
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept The four ways to respond to a risk, how the security manager recommends between them, and why the final choice belongs to the business risk owner.
- Risk Acceptance: Approval, Expiry and Review How to accept risk properly: who may approve it, what must be recorded, how policy exceptions fit in, and why every acceptance needs an expiry date.
- Cost-Benefit Analysis for Risk Treatment How to compare treatment options by what they cost and how much risk they remove, including the costs people forget and the benefits that aren't financial.
Ownership and monitoring
- Risk Ownership vs Control Ownership Who owns a risk, who owns the controls that treat it, why they're usually different people, and how clear ownership makes risk management work.
- RACI and Risk Escalation Paths Using RACI charts to make risk responsibilities clear, and designing escalation paths so risks reach the right level of authority quickly.
- The Risk Register What a risk register holds, how it's kept useful, and how the security manager uses it for decisions, reporting and tracking treatment.
- Continuous Risk Monitoring and Key Risk Indicators How the security manager keeps risk information current: monitoring changes that trigger reassessment, and key risk indicators with thresholds that warn before risk becomes an incident.
- Risk Reporting to Executives and the Board How to report information risk so that executives and the board can make decisions: the right content for each audience, in business terms, with trends and clear asks.
- Integrating Risk Management into Business and IT Processes How the security manager embeds information risk management in the processes where decisions are already made (planning, projects, change, procurement, acquisitions), so risk is managed continuously rather than once a year.