Domain 2: IT Risk Assessment

CRISC · about 22% of the exam

Identifying IT risk through threats, vulnerabilities and scenarios, then analysing and evaluating it and recording it in the risk register.

Risk events and threats

IT Risk Events, Loss Types and Business Outcomes What an IT risk event is, the common families of events, the types of loss they cause and how to trace each event through to the business outcome it threatens.
Threat Sources, Actors and Motivations The sources of threat to IT (adversarial, accidental, structural and environmental), the main threat actors and why their motivation and capability shape likelihood.
The Changing Threat Landscape and Threat Modelling How the risk practitioner keeps up with changing threats through threat intelligence, and uses threat modelling to find threats to a system before it's built.

Vulnerabilities, Control Deficiencies and Risk Conditions The kinds of weakness that let threats cause harm, from technical flaws to process and people gaps, how control deficiencies are classified and how to prioritise vulnerabilities by risk.
Identifying Internal and External Risk Factors The internal and external conditions that make IT risk events more likely or more damaging, and how the risk practitioner uses them to keep scenarios and ratings realistic.

Building IT Risk Scenarios How to write risk scenarios that the business recognises and can rate, using top-down and bottom-up approaches, and why scenarios are the core of IT risk assessment.
Evaluating Scenarios for Completeness and Relevance How to check that each risk scenario is realistic, specific, business-linked and owned, and that the set as a whole covers the organisation's key assets, processes and threats.
Common Risk Scenario Errors The mistakes that make risk scenarios useless (too vague, too technical, too extreme, too many or out of date) and how to fix each before rating.

Risk Assessment Concepts and Standards The building blocks of IT risk assessment (assets, threats, vulnerabilities, likelihood and impact), the standard process steps and the main standards that describe them.
Qualitative, Semi-Quantitative and Quantitative Analysis The three ways to analyse risk, what each is good and bad at, and how to choose the right approach for the decision and the data available.
Quantitative Methods: ALE, FAIR and Monte Carlo How to express IT risk in money, from the classic SLE and ALE formulas to FAIR and Monte Carlo simulation, and how to use the results in cost-benefit decisions.
Risk Analysis Techniques: Bow-Tie, Fault Tree, Event Tree and Delphi The structured techniques risk practitioners use to analyse causes, consequences and controls, and to get reliable estimates from experts, with guidance on when to use each.
Choosing a Consistent Assessment Methodology Why risk assessments need agreed methods, scales and criteria, how to define likelihood and impact scales the business understands, and how consistency makes results comparable over time.

Translating Technical Events into Business Impact How the risk practitioner turns technical findings and events into the business impact decision-makers act on, using agreed impact categories and the people who know the business.
Business Impact Analysis for Risk Prioritisation How a business impact analysis identifies critical processes and how quickly their disruption causes harm, and how the risk practitioner uses its results to prioritise IT risks.
Inherent and Residual Risk The difference between risk before and after controls, how to estimate residual risk realistically and why the comparison shows the value of controls.
Evaluating Risk Against Business Objectives and Appetite How risk evaluation turns analysed ratings into decisions: comparing each risk with appetite and tolerance, prioritising, and deciding which risks need a response and at what level.

Creating and Maintaining the IT Risk Register What goes into an IT risk register, who maintains it, how to keep it accurate and current, and why one consistent register is the backbone of IT risk management.
Using the Risk Register to Support Decisions How the risk register becomes a management tool rather than an archive: prioritising resources, tracking treatment, building the risk profile and informing budgets, audits and strategy.