Information Security Risk Management
The core mechanics
Risk management identifies, evaluates and treats the uncertainty that could affect business objectives. Candidates must be fluent in: risk appetite and tolerance as set by leadership; assessment approaches, qualitative (scenario ranking) versus quantitative (monetary loss estimates), and asset-based versus scenario-based scoping; the components of risk - threat, vulnerability, likelihood, impact; the risk register and its ownership; treatment options of mitigate, transfer, avoid and accept; residual risk; monitoring through key risk indicators; third-party and supply-chain risk; and integration with the wider enterprise risk management function so security risk is not managed in a silo.
Traps
The most common error is assigning risk acceptance to the wrong party. Security management identifies and quantifies risk and recommends options; the business or data owner accepts residual risk, in writing, with the information needed to judge it. Watch for choices that confuse a vulnerability assessment (a technical scan) with a risk assessment (a business-impact judgement), or that treat insurance as a full transfer when reputation and customer trust cannot be transferred. Another trap: selecting controls before understanding business requirements and asset criticality.
Worked example
A business unit wants to launch a service using a vendor with weak security practices. The wrong answer is for the CISO to block the launch unilaterally. The right answer is to document the exposure, quantify plausible business impact, present treatment options with costs, and let the accountable business owner accept the residual risk in writing - then monitor for change.
Rule of thumb: the output of risk management is an informed business decision, not a zero-risk state.