IT Risk Fundamentals flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Inherent risk

The level of risk that exists before any controls are applied, reflecting the raw exposure created by threats, vulnerabilities, and potential impact on the asset.

Residual risk

The risk remaining after existing controls are applied and evaluated for effectiveness; it is the figure compared against risk tolerance and formally accepted by the risk owner.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, stated qualitatively and quantified through tolerance thresholds approved by senior management.

Risk tolerance

The acceptable variation around the risk appetite, expressed as measurable limits or thresholds that trigger escalation when exceeded.

Risk capacity

The maximum level of risk an organization can absorb before its viability or strategic objectives are threatened; it is a hard limit, not a preference.

Single loss expectancy

The monetary loss expected from a single risk event, calculated as asset value multiplied by the exposure factor, which is the percentage of the asset damaged.

Annualized loss expectancy

The expected yearly loss from a risk, computed as single loss expectancy multiplied by the annualized rate of occurrence, used to compare risk against control cost.

Annualized rate of occurrence

The estimated frequency with which a specific threat event is expected to occur in one year, expressed as a number such as 0.5 for once every two years.

Exposure factor

The proportion of an asset's value that would be lost if a specific threat event occurred, expressed as a percentage of the asset value.

Risk register

A structured record of identified risks containing description, cause, affected asset, owner, inherent and residual ratings, controls, and treatment decision with dates.

Risk owner

The individual with authority and accountability for managing a specific risk, including approving treatment options and formally accepting residual risk on behalf of the organization.

Risk treatment options

The four responses to risk: mitigate by reducing likelihood or impact, transfer through insurance or contracts, avoid by eliminating the activity, or accept with documented approval.

Risk transfer

Shifting the financial consequence of a risk to another party, typically through insurance or contractual indemnity; accountability for the risk itself is not transferred.

Risk avoidance

Eliminating the risk by discontinuing the activity or system that creates it; effective but may forfeit business benefit, so it is chosen when risk exceeds capacity.

Key risk indicator

A forward-looking metric with defined thresholds that signals increasing exposure to a risk, enabling action before losses occur, unlike backward-looking performance metrics.

Three lines model

A governance structure where operational management owns risk, a risk and compliance function provides oversight and challenge, and internal audit provides independent assurance.

NIST SP 800-30

A risk assessment guideline defining steps to prepare for assessment, identify threat sources and vulnerabilities, determine likelihood and impact, and communicate and maintain results.

ISO 31000

An international risk management standard describing principles and a process of establishing context, identification, analysis, evaluation, treatment, monitoring, and communication, applied iteratively.

FAIR model

A quantitative risk analysis method decomposing risk into loss event frequency and loss magnitude, each broken into contributing factors such as threat event frequency and vulnerability.

COSO ERM

An enterprise risk management framework organized around governance and culture, strategy and objective-setting, performance, review and revision, and information, communication, and reporting.

Threat modeling

A structured analysis of a system design to enumerate threats and mitigations before deployment, often using frameworks such as STRIDE to categorize attack types.

STRIDE

A threat classification scheme covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, used during design review.

Vulnerability

A weakness in a system, process, or control that a threat source could exploit to cause harm; it has no risk value without a corresponding threat and impact.

Threat source

Any circumstance or actor with the potential to exploit a vulnerability and cause harm, including attackers, insiders, accidents, and environmental events.

Preventive control

A control that stops a threat event from occurring or reduces its likelihood, such as access restrictions, encryption, or segregation of duties.

Detective control

A control that identifies and records a threat event after it occurs, such as log monitoring, intrusion detection, or reconciliation, enabling timely response.

Corrective control

A control that restores systems or data after an event, such as backups, failover, or incident response procedures, reducing impact rather than likelihood.

Compensating control

An alternative control used when the primary control is impractical or unavailable, providing equivalent risk reduction that must be documented and assessed for adequacy.

Risk heat map

A visual grid plotting likelihood against impact to rank risks, with zones above tolerance requiring treatment or documented acceptance by the accountable owner.

Business impact analysis

An analysis identifying critical processes and their dependencies, and deriving recovery time objectives and recovery point objectives used to set resilience requirements.

Recovery time objective

The maximum tolerable time a process or system may be unavailable after a disruption before unacceptable business consequences occur.

Recovery point objective

The maximum tolerable amount of data loss measured in time, determining the required backup or replication frequency for a system.

Third-party risk tiering

Classifying vendors by data sensitivity and system criticality to determine the depth of due diligence, contractual controls, and ongoing assurance required.