Risk, Compliance, and Security Frameworks
This domain tests whether you can quantify and treat risk, then map obligations onto a control set without confusing a certificate with security. Expect questions on risk vocabulary, treatment options, framework structure, and scoping decisions.
Risk vocabulary that gets tested
Asset, threat, vulnerability, likelihood, impact. Inherent risk is measured before controls; residual risk after. Risk appetite is how much risk the organisation wants to pursue; risk tolerance is acceptable variance around that. Every register entry needs an owner, a treatment, and a due date.
Quantitative: SLE = asset value × exposure factor; ALE = SLE × annualised rate of occurrence. Qualitative methods use scales; semi-quantitative methods such as FAIR use calibrated ranges and simulation. NIST SP 800-30 defines the assessment process; SP 800-37 is the RMF authorisation path.
Treatments: mitigate, transfer, avoid, accept. Transfer (insurance, contract) rarely moves reputational or regulatory exposure.
Frameworks
- NIST CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, Recover.
- ISO/IEC 27001: ISMS, risk assessment, Statement of Applicability, Annex A controls via 27002, internal audit, management review.
- NIST SP 800-53: control families (AC, AU, CM, IA, SC…) with baselines.
- CIS Controls v8: 18 prioritised safeguards with implementation groups.
- SOC 2: Trust Services Criteria; Type I is point-in-time design, Type II is operating effectiveness over a period.
- PCI DSS v4.0: CDE scoping across 12 requirement families.
- GDPR, HIPAA, SOX: legal obligations, not control catalogues.
Crosswalks let one control set produce evidence for several frameworks; control inheritance applies where a provider or platform already satisfies the control.
Worked example
Payment-API fraud: exposed transaction value $2,000,000, exposure factor 25% → SLE $500,000; occurrence rate 0.4/year → ALE $200,000. A control set costs $140,000 per year including validation. Reasoning: the quantified benefit ($200,000 − estimated $60,000 residual ALE = $140,000) justifies the spend, but the decision must also weigh regulatory penalties and intangibles the ALE omits. Record the assumptions and review annually. If the control only shifts liability to a processor, the treatment is transfer, not mitigation.
Traps
- False precision in ALE inputs.
- "Compliant therefore secure."
- Treating framework adoption as a control.
- CDE scope creep through connected systems.
- Evidence of design without evidence of operating effectiveness.
- Register entries with no owner.