Risk Management
Risk management is the disciplined process of identifying, analysing, treating, and monitoring risk to information assets so that exposure stays within the organisation's appetite. The CSG exam tests your command of risk terminology, the treatment options, quantification methods, and how risk registers and third-party risk feed governance decisions.
Core concepts and process
- Risk is the effect of uncertainty on objectives, commonly expressed as likelihood multiplied by impact. A threat is something that can exploit a weakness; a vulnerability is the weakness itself; exposure is the potential loss. Confusing these three terms is the most common source of wrong answers.
- ISO 31000:2018 and NIST SP 800-39 describe a cycle: establish context and scope, identify, analyse, evaluate, treat, then communicate and monitor. NIST SP 800-39 also defines three tiers - organisation, mission/business process, and information system - so a finding at system level is escalated to the tier that can accept it.
- Treatment options are mitigate, transfer, avoid, and accept. Transfer (insurance, contract clauses) moves financial consequence, not reputation or regulatory liability - the organisation remains accountable.
- Outputs live in a risk register: risk ID, description, owner, likelihood and impact ratings, existing controls, treatment plan, residual risk, target date, and status.
Quantification, worked
An asset is valued at USD 200,000. A ransomware scenario would destroy 25% of its value, so the single loss expectancy is 200,000 × 0.25 = USD 50,000. The annualised rate of occurrence is 0.4, giving an annualised loss expectancy of 50,000 × 0.4 = USD 20,000. A control costing USD 8,000 per year reduces the occurrence rate to 0.1, so residual ALE is 50,000 × 0.1 = USD 5,000. Risk is cut by USD 15,000, and the net benefit is 15,000 − 8,000 = USD 7,000. The control is justified on quantitative grounds; qualitative factors such as regulatory exposure still need review.
Traps that cost marks
- Presenting a control as eliminating risk. Residual risk always remains and must be recorded and accepted.
- Accepting risk without the authority, a defined expiry, or a re-review trigger.
- Using inconsistent qualitative scales, so "high" means different things in different registers.
- Ignoring aggregated and correlated risk, where many small findings combine into material exposure.
- Treating a completed vendor questionnaire as sufficient third-party assurance; it is an input, not an audit.