Risk Management and Compliance
Risk Management and Compliance
This domain tests risk vocabulary, quantitative analysis, treatment decisions, and how frameworks and regulations map to controls. Expect calculation items and questions that ask who must own or approve a decision.
Risk vocabulary
Risk is the combination of likelihood and impact arising from a threat exploiting a vulnerability on an asset. Inherent risk exists before controls; residual risk remains after them. Risk appetite is how much risk the organization will accept; tolerance is the acceptable variation around that. The risk register records each risk with an owner, score, treatment, and review date - a risk without a named owner is unmanaged.
Quantitative analysis
Single Loss Expectancy = asset value × exposure factor. Annualized Loss Expectancy = SLE × ARO, where ARO is the annualized rate of occurrence. Worked example: an asset worth $200,000 with a 25% exposure factor gives an SLE of $50,000. If the event occurs roughly once every two years, ARO is 0.5 and ALE is $25,000. A control costing $10,000 per year that halves the ARO saves $12,500 annually - cost-justified. Qualitative scales (high/medium/low) are faster but less defensible to a board.
Treatment options
Avoid (stop the activity), mitigate (apply a control), transfer (insurance or contract), accept (documented, owned, time-bound). Transferring financial loss does not transfer reputational or regulatory exposure - that nuance is a frequent exam point.
Frameworks and regulations
PCI DSS covers cardholder data; HIPAA covers protected health information in the US; GDPR governs EU personal data with lawful-basis and breach-notification duties; SOX covers financial reporting controls; ISO 27001 defines an ISMS; the NIST CSF organizes outcomes into identify, protect, detect, respond, recover (with govern added in CSF 2.0); SOC 2 reports on trust services criteria. Data classification drives handling, retention, and destruction requirements.
Continuity and recovery
A business impact analysis identifies critical processes. MTD is the maximum tolerable downtime; RTO is the recovery target and must be at or below MTD; RPO is the acceptable data loss measured in time. The DRP recovers technology; the BCP keeps the business operating.
Traps
ALE is annualized - do not report a per-event figure. Audit findings stay open until remediated with evidence, not just acknowledged. Risk acceptance requires a named owner with authority, and policies state intent while standards state mandatory specifics.