Domain 2: Information Security Risk Management
Arrow keys or space to move, F for full screen. Read the notes
Information Security Risk Management
20 topics · Risk foundations · Threats and vulnerabilities · Risk analysis · Risk treatment · Ownership and monitoring
D2Risk Management Concepts and Frameworks
What information risk is, the life cycle for managing it, and the frameworks (ISO 31000, ISO 27005, NIST, FAIR, COSO, Risk IT) a security manager draws on.
What risk is
ISO 31000 defines risk as the effect of uncertainty on objectives. For information security, risk exists when something of value could be harmed because a threat could exploit a weakness. Take away any of those ingredients and the risk shrinks.
The risk management life cycle
Key terms
| Term | Meaning |
|---|---|
| Asset | Anything of value: data, systems, people, reputation |
| Threat | A potential cause of harm: attacker, error, flood |
| Vulnerability | A weakness a threat can exploit |
| Likelihood | How probable the event is |
| Impact | The harm if it happens: money, legal, customers, safety |
| Control | A measure that reduces likelihood or impact |
Frameworks you'll meet
Why one method matters
If IT rates risks on a 3-point scale and finance on a 5-point scale with different impact bands, the board can't compare them. The security manager should use the organisation's enterprise method, or align with it.
ExampleA company adopts ISO 27005 for information risk but calibrates its impact bands to the finance team's ERM scale. For the first time, the board's top-ten list mixes cyber, credit and supply-chain risks on equal terms.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Purpose of information risk management | Keep risk within appetite while supporting objectives |
| First step in the risk management process | Establish context: scope, criteria, appetite |
| Quantitative risk framework | FAIR |
| Standard for information security risk management | ISO/IEC 27005 |
| Benefit of a common method | Risks can be compared and prioritised enterprise-wide |
Key takeaways
- ✓Risk is the effect of uncertainty on objectives; information risk arises when a threat can exploit a vulnerability to harm an asset.
- ✓Risk is usually expressed as a combination of likelihood and impact.
- ✓The risk life cycle: establish context, identify, analyse, evaluate, treat, and monitor, with communication throughout.
- ✓Common frameworks: ISO 31000 (general), ISO 27005 (information security), NIST SP 800-30 and 800-39, COSO ERM, FAIR (quantitative) and ISACA Risk IT.
- ✓The purpose of information risk management is to keep risk within the organisation's appetite while supporting business objectives.
- ✓A consistent, organisation-wide method lets information risks be compared with other business risks.
Exam traps
- !Risk management aims to keep risk acceptable, not to eliminate it.
- !Establishing context (scope, criteria, appetite) comes before identifying risks.
- !A vulnerability with no credible threat, or a threat with nothing to exploit, carries little risk.
- !Using different methods in different departments makes risks impossible to compare.
Inherent Risk, Residual Risk, Appetite and Tolerance
The yardsticks of risk management: risk before and after controls, how much risk the organisation is willing and able to take, and how the security manager uses them to make decisions.
Before and after controls
Capacity, appetite, tolerance
Writing appetite down
| Vague | Usable appetite statement |
|---|---|
| 'We take security seriously.' | 'No more than 4 hours unplanned downtime for payment systems per year.' |
| 'Protect customer data.' | 'Zero tolerance for unencrypted customer data on portable devices.' |
| 'Moderate risk is fine.' | 'Residual risks rated High need executive acceptance, reviewed quarterly.' |
| 'Innovate safely.' | 'Moderate appetite for cloud and AI pilots using non-sensitive data.' |
Using the yardstick
Residual above appetiteTreat further, or escalate for acceptance at a higher level.
Residual within appetiteOwner accepts; monitor; review on change.
Residual far below appetitePossibly over-controlled; could free up money.
No appetite definedNobody can judge whether controls are enough. Raise it with management.
In practice
Appetite turns risk discussions into decisions: either the gap is closed, or someone senior knowingly accepts it.
ExampleA hospital's appetite allows no loss of patient record availability longer than 8 hours. The new records system's residual risk shows a 24-hour restore time. The CISO escalates: the board funds a standby site rather than accept the gap.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Who sets risk appetite | The board / senior management |
| Risk after controls | Residual risk |
| Goal of risk treatment | Residual risk within appetite |
| Residual risk exceeds appetite | Further treatment or escalation for acceptance |
| Acceptable variation for one objective | Risk tolerance |
Key takeaways
- ✓Inherent risk is the risk before controls; residual risk is what remains after them.
- ✓Risk appetite is the amount of risk the organisation is willing to take to pursue its objectives; the board sets it.
- ✓Risk tolerance is the acceptable variation around a specific objective; risk capacity is the most risk the organisation could survive.
- ✓Treatment aims to bring residual risk within appetite, at reasonable cost, not to reduce it to zero.
- ✓Residual risk must be formally accepted by the risk owner, at a level of authority matching its size.
- ✓Appetite statements turn a vague attitude into usable thresholds, such as 'no more than 4 hours downtime for payments'.
Exam traps
- !Appetite is set by the board and senior management, not by the CISO.
- !If residual risk exceeds appetite, more treatment or higher-level acceptance is needed; doing nothing isn't an option.
- !Risk tolerance is narrower and more specific than appetite.
- !Controls that push residual risk far below appetite may be wasting money.
Threat Actors, Motivations and Attack Vectors
Who attacks organisations and why, the most common ways in, and how understanding attackers helps the security manager assess risk realistically.
Know your adversary
A small online shop and a defence contractor face very different attackers. Understanding who would target the organisation, what they want and what they can do makes likelihood estimates realistic, and stops the program spending on threats that barely apply.
Who attacks, and why
The usual ways in
Phishing and social engineeringFake emails, calls and messages that trick people into clicking, paying or sharing.
Stolen or weak credentialsPassword reuse, no MFA, credentials bought from earlier breaches.
Unpatched vulnerabilitiesEspecially in internet-facing systems such as VPNs and web apps.
MisconfigurationOpen cloud storage, default passwords, exposed admin interfaces.
Third partiesSuppliers, software updates, managed service providers.
InsidersMisuse of legitimate access, deliberate or accidental.
How an attack unfolds
ExampleA ransomware group buys a stolen VPN password, logs in (no MFA), escalates privileges, spreads to file servers over two weeks, then encrypts them. Detection at any of those stages could have stopped the final blow.
Building a threat profile
- 1Which actors are likely, given the industry, size and geography?
- 2What assets would they want?
- 3Which vectors do they favour?
- 4What does threat intelligence say about current campaigns?
- 5Include non-malicious threats: error, failure, disaster.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Most common initial attack vector | Phishing / social engineering |
| Actor with legitimate access | Insider |
| Threat actor motivated by money | Organised crime |
| Tool listing real attacker techniques | MITRE ATT&CK |
| Why profile threat actors | Realistic likelihood and targeted controls |
Key takeaways
- ✓Threat actors differ in motivation, capability and persistence: nation-states, organised crime, hacktivists, insiders, competitors and opportunists.
- ✓Insiders include malicious people with legitimate access and careless staff who make mistakes; both are significant sources of risk.
- ✓The most common attack vectors are phishing and social engineering, stolen or weak credentials, unpatched vulnerabilities, misconfiguration and third parties.
- ✓Attacks unfold in stages (reconnaissance, initial access, foothold, lateral movement, objective), giving defenders several chances to stop them.
- ✓MITRE ATT&CK catalogues real attacker techniques and helps check whether controls cover them.
- ✓Threats also include non-malicious events: errors, system failures, natural disasters.
Exam traps
- !Not all threats are external or malicious; accidental insider errors cause many incidents.
- !Likelihood depends on the actor's motivation and capability, not just on the existence of a vulnerability.
- !A threat profile should be specific to the organisation and its industry, not a generic list.
- !Prevention alone isn't enough; attacks have stages where detection can still stop them.
The Evolving Threat Landscape: AI, Cloud and Supply Chain
The emerging risks a security manager watches today (AI, cloud, supply chain, extortion, operational technology, quantum) and a disciplined way to respond when something new appears.
The landscape never stands still
Attack techniques, technology and the business all change constantly. A risk assessment from last year may already be out of date. CISM expects the security manager to monitor for internal and external factors that require risk to be reassessed.
What's emerging now
AI, both ways
Attackers using AIFluent phishing in any language, cloned voices of executives, faster vulnerability discovery.
Risks to your AIPrompt injection, poisoned training data, models leaking sensitive data, insecure plug-ins.
Shadow AIStaff pasting confidential data into public AI tools.
Governance responseAI use policy, approved tools, data classification rules, AI risk assessments.
Responding to something new
ExampleA finance clerk receives a video call from the 'CFO' asking for an urgent transfer: a deepfake. The security manager reassesses payment fraud risk, adds a call-back rule on a known number for all transfers above a limit, and briefs finance staff, without buying new technology.
Where to watch
- 1Threat intelligence feeds and sector ISACs.
- 2Government agencies and regulators' alerts.
- 3Vendor advisories and known-exploited lists.
- 4Peers, conferences, incident reports.
- 5The organisation's own business plans: new tech, markets, suppliers.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| First step when a new threat emerges | Assess relevance and reassess risk |
| Best approach to generative AI use | Govern it: policy, approved tools, data rules |
| Main cloud risk | Misconfiguration and identity weaknesses |
| Why ransomware risk remains with good backups | Data theft and extortion |
| When to reassess risk | When internal or external factors change |
Key takeaways
- ✓Emerging risk is a CISM topic in its own right: threats, technology and the business keep changing, so risk assessments must too.
- ✓AI cuts both ways: attackers use it for convincing phishing and deepfakes; the organisation's own AI systems bring new risks such as prompt injection, data poisoning and leakage.
- ✓Cloud risk is dominated by misconfiguration and identity: stolen tokens and over-privileged accounts.
- ✓Supply chain attacks reach many victims through one trusted supplier or software update.
- ✓Ransomware groups now steal data before encrypting it, adding extortion even when backups work.
- ✓When a new threat appears, the first step is to assess its relevance and reassess risk, not to buy a product.
Exam traps
- !Reacting to headlines without assessing relevance wastes resources.
- !Banning new technology outright (such as generative AI) often drives shadow use; govern it instead.
- !Good backups don't remove the risk of data-theft extortion.
- !Emerging risks still go through the normal risk process: assess, treat within appetite, report.
Threat Modelling and Cyber Threat Intelligence
Two ways to understand threats: threat modelling looks at a system's design from the attacker's view; cyber threat intelligence tells you what attackers are actually doing.
Two views of threats
Threat modellingInside-out: looks at a specific system's design and asks how it could be attacked.
Threat intelligenceOutside-in: what attackers are actually doing, to whom, and how.
Threat modelling with STRIDE
When and how to model
- 1During design of new systems and major changes.
- 2Draw the system: components, data flows, trust boundaries.
- 3Walk each element through STRIDE (or attack trees, PASTA).
- 4Rate the threats; design controls; record decisions.
ExampleModelling a new customer portal shows the password-reset flow could be abused to take over accounts (spoofing). Adding verification to the design costs a day; fixing it after launch would have needed a release and a fraud investigation.
Levels of intelligence
The intelligence cycle
- 1 Direction What do we need to know?
- 2 Collection Feeds, ISACs, OSINT, government
- 3 Processing Filter, normalise
- 4 Analysis Relevance to us
- 5 Dissemination Right audience
- 6 Feedback Was it useful?
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Best time for threat modelling | During design |
| Threat category violating integrity | Tampering |
| Intelligence for the board | Strategic |
| Indicators such as IPs and file hashes | Technical intelligence |
| Main value of threat intelligence | Better, informed risk and control decisions |
Key takeaways
- ✓Threat modelling identifies how a system could be attacked, ideally during design, when fixing is cheapest.
- ✓STRIDE groups threats into spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.
- ✓Other methods include attack trees and PASTA; the method matters less than doing it systematically.
- ✓Cyber threat intelligence (CTI) is evidence-based knowledge about threats, used to make decisions.
- ✓CTI works at four levels (strategic, operational, tactical, technical) for different audiences.
- ✓Intelligence is only valuable if it's relevant, timely and acted on; it feeds risk assessments, controls and detection.
Exam traps
- !Threat modelling done after go-live misses the cheapest chance to fix design flaws.
- !Raw threat feeds aren't intelligence until they're analysed for relevance.
- !Strategic intelligence is for executives; technical indicators are for the SOC. Don't mix the audience.
- !Intelligence that nobody acts on has no value.
Vulnerability Assessment and Scanning
How the security manager runs a vulnerability assessment program: finding technical and non-technical weaknesses, scanning methods, and prioritising fixes by risk rather than by score.
Why it matters to risk
Risk needs a threat, a vulnerability and an asset. Vulnerability assessment finds the weaknesses, so the security manager knows where threats could get in and can fix what matters most first.
Not just missing patches
Scanning methods
| Method | What it gives |
|---|---|
| Authenticated (credentialed) | Deep view: installed software, missing patches, settings |
| Unauthenticated | What an outsider sees; misses a lot |
| External vs internal | Internet exposure vs what an insider or intruder could reach |
| Web application (DAST) | Flaws such as injection in running apps |
| Agent-based | Continuous view of laptops and cloud servers |
| Cloud posture (CSPM) | Misconfigured cloud services |
Prioritise by risk
ExampleScans report 3,000 'critical' findings. Filtering for internet-facing systems with known-exploited vulnerabilities leaves 40. The team fixes those within 7 days, and schedules the rest by asset criticality.
The program
- 1 Inventory Know every asset
- 2 Scan Regular and on change
- 3 Prioritise By risk
- 4 Remediate Owners, deadlines
- 5 Verify Rescan
- 6 Report Trends, overdue, exceptions
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Prerequisite for vulnerability scanning | Accurate asset inventory |
| Scan that finds the most | Authenticated / credentialed |
| How to prioritise vulnerabilities | By risk: exploitability, exposure, asset criticality |
| A clean scan means… | No known issues found, not that it's secure |
| Unpatchable system | Compensating controls and documented acceptance |
Key takeaways
- ✓Vulnerability assessment identifies weaknesses that threats could exploit; it feeds the risk assessment and remediation plans.
- ✓Vulnerabilities aren't only technical: processes, people and physical facilities have weaknesses too.
- ✓Scanning methods: authenticated vs unauthenticated, internal vs external, network, web application, agent-based, cloud configuration.
- ✓Prioritise by risk: severity (CVSS), active exploitation (known-exploited lists, EPSS), exposure, asset criticality and compensating controls.
- ✓A complete, current asset inventory comes first; you can't scan what you don't know about.
- ✓Track remediation against agreed timelines and rescan to verify fixes.
Exam traps
- !Fixing purely by CVSS score ignores exploitation and business criticality.
- !A clean scan only means no known issues were found by that scan.
- !Unauthenticated scans miss many vulnerabilities that authenticated scans find.
- !Vulnerability assessment finds weaknesses; penetration testing tries to exploit them. Don't confuse the two.
Control Deficiencies and Security Gap Analysis
How to find where controls are missing, badly designed or not working, compare the current state with a benchmark, and turn gaps into prioritised, root-cause fixes.
Three kinds of deficiency
Where the evidence comes from
AuditsInternal and external audit findings.
Assessments and testsRisk and maturity assessments, vulnerability scans, penetration tests.
IncidentsEvery incident shows where a control failed or was missing.
MetricsKPIs and KRIs drifting out of range.
Regulators and customersInspection findings, customer security questionnaires.
Gap analysis
Find the root cause
The same finding returning every year is a sign that only the symptom was fixed.
ExampleAudit finds 30 leavers with active accounts. IT disables them, but next year there are 25 more. The root cause: HR leaver notices go by email to whoever is on duty. The lasting fix is an automatic HR-to-identity feed, with an owner.
Prioritise and track
- 1Rate each gap by the risk it leaves.
- 2Group related gaps into initiatives.
- 3Assign owners, dates and budgets.
- 4Report progress and overdue items to the steering committee.
- 5Verify fixes before closing.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Control exists but can't meet its objective | Design deficiency |
| Good control not performed as intended | Operating deficiency |
| Same finding repeats every year | Address the root cause |
| How to prioritise gaps | By the risk they leave |
| Benchmark for gap analysis | Policy, framework, regulation or target state |
Key takeaways
- ✓A control deficiency is a missing control, a design deficiency (can't achieve its objective) or an operating deficiency (not run as designed).
- ✓Evidence of deficiencies comes from audits, assessments, tests, incidents, metrics and regulator findings.
- ✓Gap analysis compares the current state with a benchmark: policy, framework, regulation or target state.
- ✓Gaps are prioritised by the risk they leave, not by how easy they are to fix.
- ✓Find the root cause (ownership, skills, resources, process) so the gap doesn't return.
- ✓Remediation plans have owners, deadlines and budgets, and are tracked to closure.
Exam traps
- !Fixing only the symptom (one missed review) without the cause (no owner) means the gap reappears.
- !A control that exists on paper but doesn't operate is a deficiency.
- !Prioritise by risk, not by the number of gaps closed.
- !Gap analysis against a framework doesn't replace risk assessment; not every framework gap is a significant risk.
The Risk Assessment Process
The steps of an information security risk assessment, who should take part, how often it's done and what it produces for the security manager and the business.
Why assess risk?
Resources are limited. A risk assessment tells the security manager, and the business, which risks matter most, so money and effort go where they reduce the most risk. It's the foundation for the strategy, the program and every treatment decision.
The steps
Who takes part
| Participant | Contributes |
|---|---|
| Business / risk owners | Asset value, business impact, acceptance |
| IT and system owners | Systems, dependencies, existing controls |
| Security team | Threats, vulnerabilities, method, facilitation |
| Legal, compliance, privacy | Obligations and penalties |
| Internal audit | Findings as evidence (not ownership) |
When to assess
PeriodicallyAt least yearly for the enterprise; more often for critical systems.
On changeNew systems, cloud migrations, acquisitions, new suppliers, reorganisations.
On new threatsA new attack technique or exploited vulnerability relevant to us.
After incidentsAn incident shows the risk was underestimated or a control failed.
An example
Focused assessments for specific changes sit alongside the periodic enterprise assessment.
ExampleBefore moving HR to a SaaS platform, the security manager runs a focused assessment with the HR director: assets (personal and salary data), threats (account takeover, supplier breach), existing controls (SSO, supplier's SOC 2 report), and impact (privacy fines, staff trust). Two risks exceed appetite; MFA and a data-export alert are added before go-live.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| First step in a risk assessment | Identify (and value) the assets |
| Who determines business impact | The business / asset owner |
| When to reassess risk | Periodically and on significant change |
| Main output of a risk assessment | Prioritised risks for treatment decisions |
| Before selecting controls | Assess the risk |
Key takeaways
- ✓A risk assessment identifies, analyses and evaluates risks so the organisation can decide how to treat them.
- ✓The key steps: scope and criteria, identify and value assets, threats and vulnerabilities, existing controls, likelihood and impact, evaluate and record.
- ✓Identifying and valuing assets comes first; business owners provide the value and impact.
- ✓Assessments are done periodically and whenever significant change happens: new systems, acquisitions, new threats, incidents.
- ✓Business owners, IT, security and others take part; risk owners must agree the results.
- ✓The output is a prioritised set of risks, recorded in the risk register, that drives treatment decisions.
Exam traps
- !Selecting controls before assessing risk is the wrong order.
- !An annual assessment alone isn't enough when the environment changes significantly.
- !Impact is judged by the business, not estimated by IT alone.
- !Existing controls must be checked for effectiveness, not just listed.
Qualitative Risk Analysis: Likelihood and Impact
How qualitative and semi-quantitative analysis rate risks with scales and heat maps, what makes the scales reliable, and where the method falls short.
Rating without hard numbers
Most organisations don't have reliable data on how often each kind of incident happens or exactly what it would cost. Qualitative analysis uses informed judgement on defined scales instead, which is quick and good enough to decide priorities.
The heat map
Make the scales concrete
| Impact | Financial | Operations | Customers / legal |
|---|---|---|---|
| 1 Minor | < 50,000 | < 1 hour disruption | No customer impact |
| 2 Moderate | 50,000 – 500,000 | Up to 1 day | Small group affected |
| 3 Major | 500,000 – 5 million | Up to 1 week | Regulator notified |
| 4 Severe | > 5 million | > 1 week | Large fine; national news |
Strengths and weaknesses
StrengthsFast, cheap, easy to explain, works with limited data, engages business owners.
WeaknessesSubjective, inconsistent between assessors, hard to compare with costs.
Semi-quantitativeNumbers on the scales (1-5) help ranking, but 3 × 4 = 12 isn't money.
Making it reliableDefined criteria, workshops with several views, calibration, review.
In practice
Workshops with business owners give better ratings than the security team guessing alone.
ExampleIn a workshop, the operations director rates 'ransomware on warehouse systems' as Likely and Severe, using the agreed scale (over a week of disruption). It lands in the red zone of the heat map and goes straight to the top of the treatment list.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Main advantage of qualitative analysis | Quick, simple, works without hard data |
| Main disadvantage | Subjectivity |
| How to improve consistency | Defined criteria for each scale level |
| Numbers assigned to qualitative scales | Semi-quantitative analysis |
| Best tool to show the risk profile to executives | A heat map |
Key takeaways
- ✓Qualitative analysis rates likelihood and impact on descriptive scales (such as low, medium, high) and combines them into a risk level.
- ✓It's fast, easy to explain and works when hard data is scarce, so it's the most common method.
- ✓Its weakness is subjectivity: different people rate the same risk differently.
- ✓Defined scales with concrete descriptions (money, downtime, customers affected) make ratings consistent.
- ✓Semi-quantitative analysis assigns numbers to the scales, helping ranking but not producing real money values.
- ✓Heat maps show the risk profile at a glance and are good for communicating with executives.
Exam traps
- !Qualitative isn't wrong or inferior; it's the normal choice when data is limited.
- !Multiplying scale numbers (3 × 4 = 12) doesn't create a real money value.
- !Ratings without defined criteria aren't comparable between assessors.
- !A heat map communicates priority; it doesn't justify a specific spend amount by itself.
Quantitative Risk Analysis: SLE, ALE and Loss Estimation
How to put a money value on risk with SLE and ALE, how models such as FAIR improve the estimates, and when quantitative analysis is worth the effort.
Putting a price on risk
Executives think in money. Quantitative analysis expresses risk as an expected loss, so it can be compared directly with the cost of controls and with other investments.
SLE and ALE
Is the control worth it?
| Without control | With control | |
|---|---|---|
| SLE | 600,000 | 600,000 |
| ARO | 0.2 (once in 5 years) | 0.05 (once in 20 years) |
| ALE | 120,000 | 30,000 |
| Annual control cost | – | 40,000 |
| Net annual benefit | – | 120,000 − 30,000 − 40,000 = 50,000 |
Better estimates with FAIR
Choosing a method
QualitativeTriage many risks quickly; limited data; communicate priorities.
QuantitativeBig investment decisions; insurance; board wants money terms.
CombinedQualitative for the register; quantitative for the top risks.
Data sourcesIncident history, insurance claims, industry loss studies, expert ranges.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Formula for ALE | SLE × ARO |
| Formula for SLE | Asset value × exposure factor |
| Main advantage of quantitative analysis | Supports cost-benefit decisions |
| Main disadvantage | Reliable data is hard to obtain |
| When a control is cost-justified | ALE reduction exceeds annual cost |
Key takeaways
- ✓Single loss expectancy (SLE) = asset value × exposure factor: the cost of one occurrence.
- ✓Annualised loss expectancy (ALE) = SLE × annualised rate of occurrence (ARO): the expected loss per year.
- ✓Quantitative analysis supports cost-benefit decisions: a control is justified when it reduces ALE by more than it costs each year.
- ✓Its weakness is data: estimates of value, frequency and loss can be uncertain and look more precise than they are.
- ✓FAIR models risk as loss event frequency and loss magnitude, using ranges and simulation instead of single guesses.
- ✓Many organisations combine methods: qualitative to triage, quantitative for the biggest decisions.
Exam traps
- !Exposure factor is the share of value lost in one event, not a probability.
- !ARO is occurrences per year: once every 4 years is 0.25.
- !Precise-looking figures built on guesses can mislead decision makers.
- !Quantitative isn't always better; it's chosen when the decision justifies the effort and data exists.
Risk Scenarios and Prioritisation
How to describe risks as concrete scenarios the business recognises, build them top-down and bottom-up, and prioritise them for treatment.
From vague to concrete
'Cyber attack' is too vague to rate or own. 'A criminal group encrypts order-processing systems through phishing during year-end, stopping orders for five days' is something the sales director can judge and act on.
What a scenario contains
Building scenarios
Prioritising
Risk level vs appetiteAbove appetite comes first.
VelocityHow fast impact arrives: ransomware in hours vs slow data quality decay.
Legal and regulatoryFines, licence loss, mandatory reporting.
Shared causesOne weakness behind many scenarios is a high-value fix.
Watch for aggregation
Look across the register for common causes and concentrations.
ExampleThree suppliers each have a 'medium' breach risk. All three use the same cloud file-sharing provider. One incident at that provider would hit all three at once: together, a high risk the separate ratings hid.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Main benefit of risk scenarios | Make risk concrete for business owners to rate and own |
| Scenarios from business objectives | Top-down |
| Scenarios from assets and threats | Bottom-up |
| Best approach | Combine top-down and bottom-up |
| Several related medium risks | Consider aggregation; may be high together |
Key takeaways
- ✓A risk scenario describes a plausible event: actor, threat event, asset, consequence, and timing or context.
- ✓Scenarios make risk concrete, so business owners can rate likelihood and impact and take ownership.
- ✓Top-down scenarios start from business objectives; bottom-up scenarios start from assets and threats. Using both gives relevant, realistic scenarios.
- ✓Prioritisation weighs risk level against appetite, plus factors such as velocity, legal exposure and how many risks share a cause.
- ✓Related small risks can aggregate into a large one; look across scenarios, not only at each in isolation.
- ✓Keep scenarios current: review them when threats, assets or the business change.
Exam traps
- !Vague risks ('cyber attack') can't be rated or owned; write specific scenarios.
- !Ranking only by likelihood × impact can miss fast-moving or legally severe risks.
- !Hundreds of narrow scenarios bury the important ones; group them sensibly.
- !Scenarios built only by IT may miss what matters most to the business.
Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
The four ways to respond to a risk, how the security manager recommends between them, and why the final choice belongs to the business risk owner.
Four ways to respond
Choosing a response
IT examples
| Response | Example |
|---|---|
| Mitigate | MFA, patching, encryption, backups, monitoring |
| Transfer / share | Cyber insurance; indemnities in supplier contracts |
| Avoid | Stop storing card data; retire an unsupported system |
| Accept | Low-value internal wiki without MFA; documented and reviewed |
Combining responses
Most real decisions use more than one response.
ExampleAn unsupported manufacturing system can't be patched and replacing it takes two years. The plant isolates it on its own network segment and adds monitoring (mitigate), extends the cyber policy to cover business interruption (transfer), and the plant director formally accepts the remaining risk until replacement, reviewed quarterly (accept).
Who decides
Security managerAnalyses the risk, designs options, estimates cost and residual risk, recommends.
Risk ownerBusiness manager who chooses the response and accepts what remains.
Senior managementDecides when the risk is beyond the owner's authority or the appetite.
Risk registerRecords the decision, owner, actions, dates and review.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Buying cyber insurance is… | Risk transfer |
| Who decides the treatment | The risk owner |
| Goal of treatment | Residual risk within appetite, cost-effectively |
| Stopping a risky activity | Avoidance |
| Does outsourcing transfer accountability? | No |
Key takeaways
- ✓The four responses: mitigate (reduce), transfer (share), avoid (stop the activity) and accept (knowingly retain).
- ✓The goal is residual risk within appetite at reasonable cost, not zero risk.
- ✓Responses are often combined: mitigate, then insure what's left, then accept the remainder.
- ✓Transferring risk moves financial impact, not accountability, reputational damage or regulatory duty.
- ✓The security manager recommends options with costs and residual risk; the risk owner decides.
- ✓Every treatment decision is recorded in the risk register with an owner and review date.
Exam traps
- !Insurance doesn't transfer accountability or reputational damage.
- !Ignoring a risk isn't acceptance; acceptance is informed, documented and approved.
- !The security manager doesn't accept business risk on the owner's behalf.
- !Avoidance removes the risk but also the benefit of the activity.
Risk Acceptance: Approval, Expiry and Review
How to accept risk properly: who may approve it, what must be recorded, how policy exceptions fit in, and why every acceptance needs an expiry date.
Acceptance is a decision
Sometimes the best answer is to live with a risk: treatment costs more than the risk, a fix is coming later, or the risk is small. That's fine, as long as someone with authority decides knowingly, writes it down and looks at it again.
Who may accept
The acceptance process
Policy exceptions are acceptances too
When someone can't comply with a policy or standard, the exception goes through the same process.
ExampleA laboratory instrument runs an old operating system that can't take the standard endpoint agent. The lab head requests an exception. Security adds network isolation as a compensating control; the business unit head approves it for six months while the vendor certifies a newer version.
Keeping acceptances honest
- 1One register of all accepted risks and exceptions.
- 2Automatic reminders before expiry.
- 3Regular report of accepted risks to the steering committee.
- 4Reassess immediately if threats or the system change.
- 5Close the acceptance when the risk is treated.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Requirement for valid risk acceptance | Informed, documented approval at the right level |
| Who accepts a risk beyond appetite | Board / senior management |
| What every acceptance should include | Owner, reason, conditions, expiry/review date |
| A request for a policy exception | Assess risk; approve at the right level; time-limit it |
| Accepted risk changes | Reassess the acceptance |
Key takeaways
- ✓Risk acceptance is a legitimate, deliberate decision to retain a risk; it must be informed, documented and approved.
- ✓The approver's seniority depends on the size of the risk; risks beyond appetite need the board or its committee.
- ✓Each acceptance records the owner, the reason, any compensating controls and conditions, and an expiry date.
- ✓Policy exceptions are a form of risk acceptance and follow the same process.
- ✓Acceptances are reviewed at expiry and whenever the risk changes, and are then renewed, treated or closed.
- ✓The security manager tracks and reports accepted risks so they don't become forgotten permanent gaps.
Exam traps
- !The CISO doesn't accept risks for the business; the owner or management does.
- !Acceptance without an expiry or review date tends to become permanent.
- !An exception approved by someone without enough authority isn't valid acceptance.
- !Accepting a risk doesn't mean forgetting it; it stays in the register and is monitored.
Cost-Benefit Analysis for Risk Treatment
How to compare treatment options by what they cost and how much risk they remove, including the costs people forget and the benefits that aren't financial.
Is it worth it?
Every control costs something. Cost-benefit analysis asks whether the risk it removes is worth that cost, and which of several options gives the best value. It's how the security manager turns risk analysis into a sensible recommendation.
Comparing options
The costs people forget
ImplementationProject staff, consultants, integration, data migration.
RunningLicences, people to operate it, monitoring, support.
ProductivityExtra steps for users, slower processes, help-desk calls.
End of lifeUpgrades, replacement, decommissioning.
Beyond the numbers
- 1Is the control required by law, regulation or contract?
- 2Would a failure cause harm to people or safety?
- 3How would customers and regulators view the decision?
- 4Does the option fit the culture and architecture?
ExampleA hospital's analysis shows encrypting old medical devices costs more than the expected loss. But patient-safety and privacy rules require it, so the board approves it anyway, and records why.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Main purpose of cost-benefit analysis | Choose cost-effective treatment |
| Benefit of a control | Reduction in expected loss (ALE) |
| Control costs more than the loss it prevents | Usually not justified, unless required |
| Costs to include | Full life cycle, including running and productivity |
| Who decides after the analysis | The risk owner |
Key takeaways
- ✓Cost-benefit analysis compares the cost of a treatment with the risk it removes, to choose the option with the best value.
- ✓Benefit is usually the reduction in expected loss (ALE before minus ALE after).
- ✓Costs include the full life cycle: purchase, implementation, running, people, training, maintenance and impact on productivity.
- ✓A control costing more than the loss it prevents is rarely justified, unless a law or contract requires it.
- ✓Non-financial factors (regulatory requirements, reputation, safety, customer demands) also weigh in the decision.
- ✓Compare several options, including doing nothing, and choose the one that brings residual risk within appetite most cost-effectively.
Exam traps
- !Choosing the option with the most risk reduction ignores cost; choose the best value within appetite.
- !Ignoring running and productivity costs makes options look cheaper than they are.
- !Legal or regulatory requirements can override a negative cost-benefit result.
- !Cost-benefit analysis informs the risk owner's decision; it doesn't replace it.
Risk Ownership vs Control Ownership
Who owns a risk, who owns the controls that treat it, why they're usually different people, and how clear ownership makes risk management work.
Why ownership matters
A risk with no owner is a risk nobody is managing. Ownership gives every risk someone who watches it, decides what to do about it, and answers for the outcome. CISM lists 'risk and control ownership' as its own topic.
Two kinds of owner
Choosing the right risk owner
- 1The person whose objectives the risk threatens.
- 2Senior enough to decide and fund treatment.
- 3Able to accept residual risk within their authority.
- 4Named individually, not as a department.
How the pieces connect
One risk, several controls, several control owners, one accountable risk owner.
ExampleRisk: 'fraudulent payments through compromised finance accounts'. Risk owner: the CFO. Controls: MFA (owned by the IAM manager), payment approval limits (owned by the financial controller), transaction monitoring (owned by the fraud team lead). Each control owner reports failures to the CFO, who decides whether the risk is still within appetite.
The security manager's role
FacilitatesRuns the risk process, method and register.
AdvisesExplains risks and options to owners.
Owns some controlsSecurity tooling, monitoring, awareness.
EscalatesWhen owners don't act and risk exceeds appetite.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Who should own an information risk | The business manager responsible for the affected objective |
| Who accepts residual risk | The risk owner (within their authority) |
| Who ensures a specific control operates | The control owner |
| The security manager's role in ownership | Facilitate, advise, escalate |
| Best way to ensure accountability | Named owners for every risk and control |
Key takeaways
- ✓A risk owner is the person accountable for a risk and has the authority to decide how it's treated and to accept what remains.
- ✓Risk owners are usually business managers, because information risk is business risk.
- ✓A control owner is accountable for a specific control being designed, operated and evidenced correctly.
- ✓One risk can be treated by several controls with different owners; one control can treat several risks.
- ✓Every risk and every control needs a named owner, a person rather than a department.
- ✓The security manager facilitates and advises; owning the risk management process isn't the same as owning the risks.
Exam traps
- !The CISO or IT is rarely the right risk owner for a business risk.
- !'IT owns it' or 'the business owns it' isn't ownership; name a person.
- !Owning a control doesn't mean owning the risk it treats.
- !Risk owners need enough seniority and budget authority to act on the risk.
RACI and Risk Escalation Paths
Using RACI charts to make risk responsibilities clear, and designing escalation paths so risks reach the right level of authority quickly.
Who does what, exactly?
'Security is everyone's job' is true but unhelpful when a decision is needed. A RACI chart lists the key activities and says, for each one, who does it, who answers for it, who must be asked and who must be told.
A RACI example
RACI rules
ResponsibleDoes the work. Can be several people.
AccountableAnswers for the result; approves. Exactly one per activity.
ConsultedGives input before the decision (two-way).
InformedTold afterwards (one-way).
Escalation paths
When to escalate
- 1Residual risk exceeds appetite or the owner's authority.
- 2An owner can't, or won't, act on a high risk.
- 3Remediation actions are significantly overdue.
- 4A major incident, or a new threat with high impact.
- 5Conflict between business units over a risk decision.
ExampleA business unit has delayed fixing a high-rated access risk for three quarters. Under the agreed thresholds, the security manager takes it to the steering committee, which sets a deadline and funds a contractor. No personal confrontation needed.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| How many Accountable per activity | Exactly one |
| Person who does the work | Responsible |
| Owner won't treat a high risk | Escalate per the agreed path |
| Benefit of agreed thresholds | Consistent, timely, non-personal escalation |
| Risk beyond appetite goes to… | Senior management / board |
Key takeaways
- ✓RACI shows who is Responsible (does the work), Accountable (answers for it), Consulted and Informed for each activity.
- ✓Each activity has exactly one Accountable person; several people can be Responsible.
- ✓RACI charts remove confusion about who decides, who acts and who just needs to know.
- ✓Escalation paths send risks to the level of authority that matches their size, using agreed thresholds.
- ✓Escalate when risk exceeds appetite, an owner can't or won't act, actions are overdue, or a major incident occurs.
- ✓Pre-agreed escalation criteria make escalation routine rather than personal.
Exam traps
- !Two Accountable people for one activity means nobody is really accountable.
- !The security manager escalating a business risk isn't disloyalty; it's the job.
- !Escalation goes up the line of authority, not straight to the board for everything.
- !Responsible and Accountable are different: the person doing the work isn't necessarily the one who answers for it.
The Risk Register
What a risk register holds, how it's kept useful, and how the security manager uses it for decisions, reporting and tracking treatment.
One place for every risk
Risks identified in assessments, audits, incidents and projects need one home. The risk register is that home: a living record of what could go wrong, who owns it, what's being done and how it's changing.
What's in a row
Keeping it alive
After assessmentsNew risks added; ratings refreshed.
After incidentsRatings and controls reconsidered.
On changeNew systems, suppliers, regulations.
Treatment progressActions completed, overdue or blocked.
Using it for decisions
- 1Top-risk reports for the steering committee and board.
- 2Trends: which risks are rising or falling.
- 3Overdue treatment actions and who owns them.
- 4Accepted risks and their expiry dates.
- 5Input to budget and roadmap priorities.
ExampleBefore the budget round, the security manager filters the register for residual High risks with no funded action. Five appear; each becomes a line in the business case, with its owner as sponsor.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Main purpose of a risk register | Central record to track and manage risks |
| Key fields | Owner, ratings, treatment, status, review date |
| When to update it | Continuously: assessments, incidents, changes |
| Best link for information risks | Integrated with the enterprise risk register |
| Who can see it | Restricted; it shows the organisation's weaknesses |
Key takeaways
- ✓A risk register is the central record of identified risks, their owners, ratings, treatments and status.
- ✓Typical fields: ID and scenario, owner, inherent and residual ratings, existing controls, treatment decision, actions, due dates, status, review date.
- ✓Information risks should sit in, or link to, the enterprise risk register so they're seen alongside other business risks.
- ✓The register is updated after assessments, incidents, changes and treatment progress; stale registers mislead.
- ✓It feeds reporting: top risks, trends, overdue actions and accepted risks.
- ✓Access to the register should be controlled; it's effectively a map of the organisation's weaknesses.
Exam traps
- !A register that's only updated once a year is a snapshot, not a management tool.
- !Listing risks without owners, ratings or actions isn't risk management.
- !Separate, unlinked security and enterprise registers hide information risk from the board.
- !The register itself is sensitive; protect it.
Continuous Risk Monitoring and Key Risk Indicators
How the security manager keeps risk information current: monitoring changes that trigger reassessment, and key risk indicators with thresholds that warn before risk becomes an incident.
Risk doesn't stand still
A risk assessment describes one moment. Threats evolve, systems change, suppliers come and go, and controls quietly degrade. Continuous monitoring keeps the risk picture current, so decisions aren't based on last year's facts.
What triggers reassessment
Key risk indicators
Thresholds make KRIs work
Examples of good KRIs
| Risk | KRI |
|---|---|
| Ransomware | % critical servers without offline backup in last 7 days |
| Account takeover | % privileged accounts without MFA |
| Insider data loss | Leavers with active accounts after 24 hours |
| Supplier breach | Critical suppliers overdue for security review |
| Phishing | Phishing simulation click rate; report rate |
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Indicator that warns risk is rising | Key risk indicator (KRI) |
| What makes a KRI useful | Linked to a risk, with thresholds and an owner |
| When to reassess risk | On schedule and when factors change |
| Best KRIs are… | Leading, giving early warning |
| KRI exceeds threshold | Trigger the agreed response / escalation |
Key takeaways
- ✓Risk changes constantly, so it's monitored continuously, not only at the annual assessment.
- ✓Triggers for reassessment include new threats, business and technology change, incidents, KRI breaches, regulation and supplier changes.
- ✓A key risk indicator (KRI) is a metric that signals a change in risk exposure, ideally before harm occurs (leading).
- ✓Good KRIs are linked to specific risks, measurable, timely, owned and have thresholds that trigger action.
- ✓KRIs differ from KPIs (process performance) and KGIs (goal achievement).
- ✓Monitoring also checks that controls keep working and that treatment actions are delivered.
Exam traps
- !A KRI without thresholds and a named response is just a number on a report.
- !Lagging indicators (losses already suffered) warn too late on their own.
- !Too many KRIs dilute attention; pick the few that track the top risks.
- !Monitoring that nobody reviews isn't monitoring.
Risk Reporting to Executives and the Board
How to report information risk so that executives and the board can make decisions: the right content for each audience, in business terms, with trends and clear asks.
Reports are for decisions
A risk report has one job: help someone decide. If the reader can't tell which risks matter, whether they're getting better or worse, and what they're being asked to do, the report has failed, however much data it contains.
Different readers, different reports
What a board report contains
- 1Top risks compared with appetite, on a heat map.
- 2Trends: what's moved since last time, and why.
- 3Significant incidents and lessons.
- 4Treatment progress, overdue actions, accepted risks.
- 5Non-compliance and emerging risks.
- 6Decisions needed from the board.
Business terms, not technical terms
| Technical | Business |
|---|---|
| '12,000 blocked intrusion attempts.' | 'Risk of a payments outage is down from High to Medium.' |
| 'CVSS 9.8 on edge devices.' | 'Our remote access could be used to stop production within days.' |
| 'SIEM coverage at 64%.' | 'A third of our critical systems could be breached without us noticing.' |
Timing and honesty
Significant changes are reported when they happen. Bad news reported early and accurately builds credibility.
ExampleTwo days after the quarterly report, a critical supplier suffers a breach involving the company's customer data. The CISO doesn't wait for the next quarter: the CEO and the chair of the risk committee are briefed the same day, with the facts known, the likely impact and the decisions needed.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Most important content of a board report | Top risks vs appetite, in business terms |
| Main purpose of risk reporting | Support informed decisions |
| Significant new risk appears | Report promptly, outside the normal cycle |
| Best way to show progress | Trends over time |
| Tailoring reports | Content and detail matched to the audience |
Key takeaways
- ✓Risk reporting exists to support decisions; every report should make clear what, if anything, the reader needs to decide.
- ✓Tailor reports to the audience: the board needs top risks against appetite and trends; owners need detail on their risks.
- ✓Report in business terms (impact on objectives, money, customers, compliance), not technical detail.
- ✓Include trends, changes since the last report, overdue actions, accepted risks and non-compliance.
- ✓Be accurate and timely; report significant changes and incidents promptly, not only at the next scheduled report.
- ✓Honest reporting of bad news builds credibility; hiding it destroys trust.
Exam traps
- !Technical metrics (alerts blocked, patches applied) aren't board risk reporting.
- !A report without trends or comparison with appetite gives no basis for decisions.
- !Significant new risks shouldn't wait for the quarterly cycle.
- !Reporting only good news undermines the security manager's credibility.
Integrating Risk Management into Business and IT Processes
How the security manager embeds information risk management in the processes where decisions are already made (planning, projects, change, procurement, acquisitions), so risk is managed continuously rather than once a year.
Risk where decisions happen
Most new risk is created by decisions: a new project, a supplier, a system change, an acquisition. If risk is only assessed once a year, those decisions go unchecked in between. Integration puts a risk question inside each decision process.
Touchpoints
Projects and the SDLC
Making it easy
ProportionateQuick rating first; full assessment only for high-risk items.
Standard toolsTemplates, questionnaires, common risk scales.
Risk championsTrained people inside business units and IT teams.
Feedback loopIncidents, audits and tests update the register.
ExampleA company adds a five-question security screen to its project intake form. Low-risk projects pass straight through; about one in six triggers a full assessment. Security now hears about new cloud services before contracts are signed, instead of after go-live.
Signs it's working
- 1Risks are raised by the business, not only by security.
- 2Projects include security costs in their business cases.
- 3Few 'surprise' systems found by discovery tools.
- 4The risk register changes between annual assessments.
How the exam asks about it
| If the question asks… | Answer |
|---|---|
| Best way to keep risk assessment current | Integrate it into change, project and procurement processes |
| When to assess a new project's risk | Early, at initiation and design |
| How to avoid slowing the business | Proportionate, risk-tiered checkpoints |
| Who owns risks found in projects | The business / project owner |
| Goal of integration | Risk management becomes part of normal business processes |
Key takeaways
- ✓Facilitating the integration of information risk management into business and IT processes is a CISM task.
- ✓Risk is managed best where decisions happen: strategic planning, projects and the SDLC, change management, procurement, mergers and acquisitions.
- ✓Integration uses proportionate checkpoints: a quick risk rating for everything, deeper assessment only where the rating is high.
- ✓Standard templates, risk criteria and risk champions make it easy for the business to do it themselves.
- ✓Outputs from incidents, audits and tests flow back into the risk register.
- ✓The goal is that risk management becomes part of how the business works, not a separate activity run by security.
Exam traps
- !An annual risk assessment alone misses risks created by changes during the year.
- !Making every change go through a full risk assessment creates delays and workarounds; scale the effort to the risk.
- !Security reviewing a project after it's built is too late to influence the design cheaply.
- !Integration doesn't transfer ownership: business owners still own their risks.
1 / 179