IT Risk Fundamentals key terms

The possibility that a threat exploits a weakness in information systems or technology processes, causing harm to confidentiality, integrity, availability, or business objectives. It combines likelihood and impact and is managed through deliberate decisions.

The coordinated set of activities used to identify, assess, treat, monitor, and communicate risks so that losses stay within acceptable limits and opportunities are taken knowingly rather than by accident.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms and approved by senior leadership. It guides which risks are tolerated and which require action.

The acceptable variation around the risk appetite for a specific area or metric, such as a maximum downtime per quarter. It translates broad appetite statements into practical thresholds that trigger escalation or corrective action.

The maximum level of risk an organization can absorb before its solvency, reputation, or ability to operate is seriously threatened. Capacity is a hard limit, while appetite is a chosen position below that limit.

The level of risk that exists before any controls or mitigating actions are applied. It reflects the nature of the asset, threat environment, and exposure, and provides a baseline for judging whether controls are worth their cost.

The risk that remains after existing controls and treatments have been applied. It is compared against risk tolerance to decide whether further action, transfer, or formal acceptance is required by an accountable owner.

The overall process of identifying risks, analyzing their causes and consequences, and evaluating them against risk criteria. Its outputs support prioritization and the selection of appropriate treatments.

The step of discovering, recognizing, and describing risks that could affect objectives, including their sources, events, and potential consequences. Techniques include workshops, threat modeling, incident review, and asset inventories.

The process of understanding the nature of an identified risk and determining its level by considering likelihood, impact, and existing controls. It may be qualitative, semi-quantitative, or quantitative depending on data available.

Comparing the results of risk analysis with established risk criteria to decide whether a risk is acceptable or needs treatment. It turns analysis into a decision about priority and response.

The reference values, thresholds, and rules used to judge the significance of a risk, such as financial loss limits or severity scales. Clear criteria keep assessments consistent across teams and time periods.

The chance that a threat event or risk scenario will actually occur within a defined period, given current conditions. It is often expressed as a frequency, probability, or qualitative rating such as low, medium, or high.

The magnitude of harm a risk event would cause if it occurred, measured in financial, operational, legal, regulatory, safety, or reputational terms. Impact assessment considers both immediate effects and longer-term consequences.

A grid that plots likelihood against impact to assign risk ratings and priorities. It supports consistent comparison of diverse risks but depends on well-defined scales and should not imply false precision.

A structured record of identified risks, including owners, causes, current controls, ratings, treatments, and review dates. It serves as the working inventory that supports monitoring, reporting, and audit evidence.

The individual with authority and accountability for managing a specific risk, including approving treatments and accepting residual exposure. Ownership should sit with the person who can direct the necessary changes.

The process of selecting and implementing options to modify risk, commonly by avoiding, reducing, sharing, or accepting it. Each option is weighed for cost, feasibility, and effect on residual risk.

A treatment that eliminates the activity or exposure that creates a risk, for example by discontinuing a service or declining a project. It removes the risk but may forgo business benefits or create new risks elsewhere.

A treatment that lowers either the likelihood or the impact of a risk through controls such as patching, segmentation, training, or redundancy. The objective is to bring residual risk within tolerance at an acceptable cost.

Shifting the financial consequence of a risk to another party, typically through insurance, contracts, or outsourcing arrangements. Accountability usually remains with the original organization even when loss is shared.

A formal decision to retain a risk without further treatment because it falls within tolerance or the cost of action outweighs the benefit. It should be documented, time-bound, and approved by the accountable owner.

A measure that modifies risk by preventing, detecting, correcting, or compensating for weaknesses. Controls can be technical, administrative, or physical, and their design and operating effectiveness must be tested.

A safeguard intended to stop an undesirable event before it occurs, such as access restrictions, input validation, or segregation of duties. Effectiveness depends on consistent application and periodic review.

A safeguard designed to identify an event after it has happened so that a response can follow, such as log monitoring, reconciliation, or intrusion detection alerts. Detection shortens exposure but does not stop the initial event.

Any circumstance or actor with the potential to exploit a vulnerability and cause harm, including criminals, insiders, malware, natural events, and errors. Threats are assessed for capability, intent, and targeting.

A weakness in a system, process, or control that a threat could exploit, such as an unpatched server, weak authentication, or missing segregation of duties. Vulnerabilities are found through scanning, testing, and review.

A person or group that carries out or sponsors attacks, ranging from opportunistic criminals and hacktivists to organized crime and state-backed groups. Their motivation and resources shape the threats an organization faces.

A structured method for identifying threats, attack paths, and weaknesses against a system design before deployment. It typically examines assets, entry points, trust boundaries, and attacker goals to prioritize mitigations.

The ongoing cycle of discovering, classifying, prioritizing, remediating, and verifying weaknesses across technology assets. Prioritization considers exploitability, exposure, and business criticality rather than raw counts alone.

The defined approach, scales, formulas, and evidence requirements used to perform risk assessments consistently. It specifies how likelihood and impact are rated and how results are recorded and reviewed.

A measurable metric that provides early warning that a risk is increasing or that controls are weakening, such as rising failed login attempts or overdue patches. Indicators are monitored against thresholds and reported to management.

The process of identifying critical business functions and estimating the consequences of their disruption over time. It establishes recovery priorities, recovery time objectives, and recovery point objectives used in continuity planning.

The maximum acceptable duration for restoring a process or system after a disruption. It drives continuity and recovery design and is derived from the business impact analysis rather than from technical preference.

The maximum acceptable amount of data loss measured in time before a disruption, indicating how far back recovery may restore. It determines backup frequency and replication design for each system.

The risk that vendors, suppliers, or service providers fail to meet security, privacy, or performance obligations and thereby harm the organization. It is managed through due diligence, contractual controls, and ongoing monitoring.

The evaluation of a supplier's security posture, financial stability, and compliance before and during a relationship. It may include questionnaires, certifications, audits, and defined remediation requirements.

The reasonable investigation and verification performed before entering a relationship or decision, and periodically thereafter. In IT risk it covers security practices, legal compliance, financial viability, and control maturity.

The communication of risk information to decision-makers in a form that supports action, including ratings, trends, exposures, and treatment status. Good reporting is timely, comparable, and linked to business objectives.