Information Security Risk Management
CISM treats risk management as a continuous business process, not an annual IT exercise. The exam tests the vocabulary precisely and tests judgement about who decides. Risk is the combination of the probability of an event and its consequence; it is expressed against assets, threats and vulnerabilities, and it is always assessed relative to business objectives.
Core rules
- Appetite vs tolerance. Risk appetite is the amount of risk the organisation is willing to pursue to meet objectives, set by senior management. Risk tolerance is the acceptable variation around that appetite for a specific area. Controls are chosen to bring risk inside the appetite.
- Process. Identify (assets, threats, existing controls) → analyse (qualitative scenario ranking or quantitative annualised loss) → evaluate against criteria → treat → monitor and communicate. Residual risk is what remains after treatment and must be re-assessed and recorded.
- Treatment options. Mitigate (reduce likelihood or impact), transfer (insurance, contract - transfers financial consequence, not accountability), avoid (stop the activity), accept (documented, by the business owner). Risk acceptance is a business decision made at the level that owns the asset.
- Quantitative basics. SLE = asset value × exposure factor. ALE = SLE × annualised rate of occurrence. Compare ALE against the total annual cost of the control; a control costing more than the loss it prevents is hard to justify on economics alone, though regulatory drivers may override.
- Register and KRIs. Each entry carries an owner, treatment plan, due date and status. Third-party and supply-chain risk is assessed with the same rigour as internal risk.
Worked example
A customer database is valued at $200,000. A breach would destroy 40% of its value; the modelled frequency is once every two years. SLE = $80,000, ALE = $40,000. A proposed control costs $15,000 per year and reduces likelihood by roughly half. Expected loss avoided ≈ $20,000 against $15,000 spend - defensible, but thin; the decision should also weigh regulatory penalties, reputational loss and the fact that the ARO input is an estimate. Document assumptions, then let the risk owner decide.
Traps that cost marks
- Answering "eliminate the risk" - residual risk is normal and acceptance is legitimate.
- Letting the security manager accept business risk.
- Confusing a BIA (recovery priorities and time objectives) with a risk assessment (likelihood and impact of events).
- Forgetting to re-assess residual risk after controls are implemented.