Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
The Risk Assessment Process
Why assess risk?
Resources are always limited. A risk assessment tells the security manager, and the business, which risks matter most, so money and effort go where they reduce the most risk. It’s the foundation for the strategy, the program and every treatment decision.
The steps
- Scope and criteria: what’s in scope; the agreed likelihood and impact scales; the risk appetite.
- Identify and value assets: information, systems and processes, and their value to the business. Owners provide the value.
- Threats and vulnerabilities: what could happen, and which weaknesses it could exploit.
- Existing controls: what’s already in place, and whether it actually works.
- Likelihood and impact: analyse each risk scenario, qualitatively or quantitatively.
- Evaluate and record: compare with appetite, rank, and record in the risk register.
The results are then communicated to risk owners and management for treatment decisions.
Who takes part
| Participant | Contributes |
|---|---|
| Business and risk owners | Asset value, business impact, acceptance of results |
| IT and system owners | Systems, dependencies, existing controls |
| Security team | Threats, vulnerabilities, method, facilitation |
| Legal, compliance, privacy | Obligations and penalties |
| Internal audit | Findings as evidence, without owning the assessment |
When to assess
- Periodically: at least yearly for the enterprise view, more often for critical systems.
- On change: new systems, cloud migrations, acquisitions, new suppliers, reorganisations.
- On new threats: a new attack technique or an exploited vulnerability relevant to the organisation.
- After incidents: an incident shows a risk was underestimated or a control failed.
Example. Before moving HR to a SaaS platform, the security manager runs a focused assessment with the HR director: assets (personal and salary data), threats (account takeover, supplier breach), existing controls (single sign-on, the supplier’s SOC 2 report) and impact (privacy fines, staff trust). Two risks exceed appetite, so MFA and a data-export alert are added before go-live.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| First step in a risk assessment | Identify and value the assets |
| Who determines business impact? | The business / asset owner |
| When should risk be reassessed? | Periodically and on significant change |
| Main output of a risk assessment | Prioritised risks for treatment decisions |
| What comes before selecting controls? | Assessing the risk |
In short
- A risk assessment identifies, analyses and evaluates risks so the organisation can decide how to treat them.
- The key steps: scope and criteria, identify and value assets, threats and vulnerabilities, existing controls, likelihood and impact, evaluate and record.
- Identifying and valuing assets comes first; business owners provide the value and impact.
- Assessments are done periodically and whenever significant change happens: new systems, acquisitions, new threats, incidents.
- Business owners, IT, security and others take part; risk owners must agree the results.
- The output is a prioritised set of risks, recorded in the risk register, that drives treatment decisions.
Exam traps
- Selecting controls before assessing risk is the wrong order.
- An annual assessment alone isn't enough when the environment changes significantly.
- Impact is judged by the business, not estimated by IT alone.
- Existing controls must be checked for effectiveness, not just listed.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The steps
1 / 9