Risk Management and Compliance
Risk management is the disciplined process of identifying, analysing, treating and monitoring uncertainty that could affect information assets. Compliance is demonstrating conformance to obligations: laws, regulations, contracts and internal policy. The exam tests the mechanics, so expect to compute an annualised loss, select a treatment, and distinguish a compliance gap from a control failure.
Assessment workflow
- Frame scope and method first (ISO 31000, NIST SP 800-30 style): what is in scope, what criteria define risk, who signs off.
- Identify assets, threats, vulnerabilities and existing controls. A risk exists only where a threat can act on a vulnerability to affect an asset.
- Analyse likelihood and impact, then evaluate against risk appetite to decide whether treatment is needed.
- Treat by mitigating (add control), transferring (insurance, contract), avoiding (stop the activity) or accepting (documented, owned, time-bound).
- Record every entry in a risk register with owner, score, treatment, target date and review cadence.
Quantitative basics
Single loss expectancy equals asset value multiplied by exposure factor. Annualised loss expectancy equals SLE multiplied by annualised rate of occurrence. These are estimates, not precision; show the arithmetic and state the caveat.
Compliance mechanics
Select a control framework (ISO/IEC 27001 Annex A, NIST CSF), run a gap analysis comparing current state to required state, and record a statement of applicability showing which controls apply and why. Compliance is not security: passing an audit shows evidence existed at a point in time, not that risk is low.
Worked example
A customer database is valued at 900,000. A breach would destroy 40 percent of value, so SLE is 360,000. History suggests one such event every six years, so ARO is about 0.167 and ALE is roughly 60,000. A control costing 25,000 per year that halves likelihood saves about 30,000 in expected loss and is justified; one costing 80,000 is not. The organisation may still accept the risk, but the rationale, owner and review date must be recorded.
Traps
- Mixing ARO (events per year) with the probability of a single event.
- Describing a risk as the absence of a control instead of an event and its consequence.
- Accepting risk with no owner or expiry.
- Claiming certification proves the organisation is secure.