Cybersecurity risk management and controls
What the exam tests
This domain tests risk-based selection and monitoring of cybersecurity controls, including assets, dependencies, threats, vulnerabilities, likelihood, impact, treatment and residual risk.
Core process
- Establish context and scope; inventory information, services, people, technology and supplier dependencies.
- Identify threats and vulnerabilities; estimate likelihood and impact; compare with risk criteria.
- Treat risk by avoiding, reducing, transferring or accepting it. Controls may be technical, organizational, legal or procedural.
- Record risk owners, treatment plans, target dates and residual risk. Monitor changes and re-assess.
- Typical controls include identity and access management, patching, segmentation, logging and monitoring, encryption, malware protection, backup, configuration management, supplier requirements and awareness.
Compliance with a checklist is not a risk assessment. A cloud provider's controls do not remove the customer's responsibility to specify, verify and monitor.
Worked example
A SaaS CRM holds customer personal data. Credential stuffing is likely because there is no MFA; impact is high because the data is regulated. Existing controls: password policy and basic logging. Treatment: MFA, rate limiting, alerting and supplier assurance. Residual risk is medium, accepted by the risk owner with quarterly review. The reasoning shows likelihood and impact, existing controls, treatment and residual risk - not simply 'add MFA'.
Traps
Incomplete asset inventory; confusing a vulnerability with a risk; treating a control list as an assessment; ignoring suppliers; forgetting residual risk and acceptance; assuming cloud transfers all risk.