Cybersecurity Risk Management and Frameworks
Core concepts
Risk is the combination of threat, vulnerability, and impact, moderated by likelihood. Distinguish inherent risk (before controls) from residual risk (after controls) and know that acceptance of residual risk belongs to the business owner, not the security team.
Be fluent in the major frameworks and what each is for. NIST CSF organizes outcomes into Identify, Protect, Detect, Respond, Recover, and Govern - it is outcome-based and voluntary. NIST RMF is a seven-step process (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) used for federal systems. ISO/IEC 27001 is a certifiable management-system standard (ISMS) with Annex A controls. CIS Controls are prioritized, prescriptive safeguards. FAIR is a quantitative risk-analysis methodology. COSO addresses enterprise risk and internal control.
Traps: (1) Treating a framework as a certification when it is guidance (CSF is not certifiable). (2) Confusing qualitative heat maps with quantitative analysis - FAIR produces monetary estimates. (3) Forgetting that risk treatment options are mitigate, transfer, avoid, accept, and that "accept" requires documented authority.
Know risk register mechanics: owner, likelihood, impact, treatment, target date, and status. Understand control selection driven by risk assessment rather than by vendor offerings, and continuous monitoring as an ongoing authorization activity.
Worked example: A team finds a critical unpatched server. Inherent risk is high. They apply network segmentation and virtual patching, reducing likelihood; residual risk drops to medium. The business owner formally accepts the medium residual risk in the register with a review date. That acceptance - not the technical fix alone - closes the governance loop.