Privacy and Security Risk Management and Safeguards
What this domain tests
Risk management questions ask you to identify threats and vulnerabilities, estimate likelihood and impact, select safeguards, and treat residual risk. Know the difference between a threat (a source of harm), a vulnerability (a weakness a threat can exploit), and risk (the combination of likelihood and impact). Know the safeguard families: administrative (policies, training, workforce controls), physical (facility access, device controls, disposal), and technical (encryption, access control, logging, authentication).
Concepts to master
- Risk assessment process: inventory data and assets, identify threats and vulnerabilities, analyze likelihood/impact, then treat.
- Treatment options: mitigate, transfer, avoid, accept-each with documented rationale and an owner.
- Defense in depth: layered controls so a single failure does not cause a breach.
- Least privilege and role-based access, plus periodic access recertification.
- Encryption and key management as a safeguard that can also affect breach-notification obligations.
- Residual risk must be accepted by an accountable person, not silently ignored.
Traps
- Confusing threat with vulnerability (a hacker is a threat; an unpatched server is a vulnerability).
- Choosing a technical control when the scenario's weakness is human or process-based (training, sanctions, workflow redesign).
- Assuming encryption eliminates risk; it reduces likelihood/impact but keys, endpoints, and metadata still need protection.
- Forgetting that risk acceptance requires documentation and authority.
Rule of thumb
Match the safeguard to the nature of the weakness: people and process → administrative; facilities and devices → physical; systems and data → technical. Layer them.
Worked example: A laptop with unencrypted records is stolen from a locked office. The vulnerabilities are both physical (portable device, weak storage controls) and technical (no encryption). The best answer combines full-disk encryption, device-tracking/asset inventory, and a clean-desk/secure-storage procedure-not a single control.