Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
Risk Scenarios and Prioritisation
From vague to concrete
“Cyber attack” is too vague to rate, own or treat. “A criminal group encrypts order-processing systems through phishing during year-end, stopping orders for five days and stealing customer data” is something the sales director can judge, own and act on. Risk scenarios turn abstract risk into stories the business recognises.
What a scenario contains
| Element | Question | Example |
|---|---|---|
| Actor | Who or what? | A criminal group |
| Threat event | What happens? | Ransomware delivered by phishing |
| Asset | What’s affected? | Order-processing systems and customer data |
| Consequence | What’s the impact? | Orders stop for five days; data stolen |
| Time and context | When does it matter most? | During the year-end peak |
Building scenarios
- Top-down starts from business objectives: what would stop us meeting our goals? It keeps scenarios relevant and engages executives.
- Bottom-up starts from assets, threats and vulnerabilities: which threats affect which assets? It keeps scenarios realistic and detailed.
The best results come from combining both, then grouping narrow scenarios into a manageable set (often a few dozen, not hundreds).
Prioritising
Once rated, scenarios are prioritised. The main factor is risk level against appetite, but also consider:
- velocity: how fast impact arrives (ransomware in hours vs slow decay of data quality)
- legal and regulatory exposure: fines, licence loss, mandatory reporting
- shared causes: one weakness behind many scenarios is a high-value fix
- trends: is the risk growing?
Watch for aggregation
Example. Three suppliers each have a “medium” breach risk. All three use the same cloud file-sharing provider. One incident at that provider would hit all three at once: together, a high risk that the separate ratings hid.
Look across the register for common causes, shared suppliers and concentrations of risk.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Main benefit of risk scenarios | They make risk concrete for business owners to rate and own |
| Scenarios built from business objectives | Top-down |
| Scenarios built from assets and threats | Bottom-up |
| Best approach | Combine top-down and bottom-up |
| Several related medium risks | Consider aggregation; together they may be high |
In short
- A risk scenario describes a plausible event: actor, threat event, asset, consequence, and timing or context.
- Scenarios make risk concrete, so business owners can rate likelihood and impact and take ownership.
- Top-down scenarios start from business objectives; bottom-up scenarios start from assets and threats. Using both gives relevant, realistic scenarios.
- Prioritisation weighs risk level against appetite, plus factors such as velocity, legal exposure and how many risks share a cause.
- Related small risks can aggregate into a large one; look across scenarios, not only at each in isolation.
- Keep scenarios current: review them when threats, assets or the business change.
Exam traps
- Vague risks ('cyber attack') can't be rated or owned; write specific scenarios.
- Ranking only by likelihood × impact can miss fast-moving or legally severe risks.
- Hundreds of narrow scenarios bury the important ones; group them sensibly.
- Scenarios built only by IT may miss what matters most to the business.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What a scenario contains
Building scenarios