I85PREP
⌘ K
CISEC-IT study materials
CISEC-IT study resources

CISEC-IT: Risk Management and Enterprise Risk Frameworks

CISEC-IT · Work through your exam, one topic at a time.

All guide sections

Risk Management and Enterprise Risk Frameworks

Risk Management and Enterprise Risk Frameworks

This domain tests whether you can run risk as a decision system rather than a spreadsheet ritual. Expect questions on appetite versus tolerance, quantitative estimation, framework steps, treatment selection, and how risk aggregates to enterprise level.

Appetite, tolerance, capacity

  • Risk appetite is the amount and type of risk leadership will accept while pursuing objectives. Tolerance is the acceptable variation around a specific metric. Capacity is the maximum loss the organisation could absorb before failure.
  • Appetite is expressed qualitatively for the board and quantitatively for operations, for example: "no more than $X expected annual loss from customer data compromise."

Frameworks and process

  • ISO 31000 provides principles and a process: scope and context, identify, analyse, evaluate, treat, monitor and review, communicate and consult.
  • The NIST Risk Management Framework runs: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.
  • ISO 27005 and OCTAVE add information-security specifics; FAIR decomposes risk into loss-event frequency and loss magnitude and supports Monte Carlo simulation and loss-exceedance curves.

Treatment and residual risk

Treatment options are modify (mitigate), retain (accept), avoid, and share (transfer or insure). Inherent risk is measured before controls; residual risk after. Residual risk must be accepted by the risk owner at the correct level of authority, recorded with a review or expiry date.

Worked example

A fleet of 500 laptops, each valued at $2,000, exposure factor 100%, theft or loss rate 4% per year. SLE = $2,000; ARO = 0.04; ALE = $80 per device, $40,000 fleet-wide. Full-disk encryption with central key escrow costs $25,000 per year and drops the exposure factor to roughly 10%, giving residual ALE near $4,000. Expected benefit is about $36,000 against $25,000 cost, so the control is justified - but the analysis should flag the breach-notification and reputational exposure the ALE omits. Reasoning: quantify what is quantifiable, label what is not, and let the accountable owner decide.

Traps that cost marks

  • Presenting a heat map without defined likelihood and impact scales; assessors then disagree and the register becomes opinion.
  • Treating the register as a compliance deliverable: stale entries, no owners, no review dates.
  • Using appetite and tolerance interchangeably in board papers.
  • Ignoring aggregation and concentration: forty "low" risks on one shared platform can be a high enterprise risk.
  • Never re-testing residual risk after treatment is implemented.