Information security risk management
What the domain tests
This domain tests the risk management practice applied to information security: how risk is identified, assessed, treated, monitored and communicated across value streams. Expect questions on risk appetite, treatment options, residual risk and the difference between a risk and an issue.
Core rules
- Risk is uncertainty of outcome; information security risk focuses on threats to confidentiality, integrity and availability.
- Risk management is continual, not a one-off assessment. Embed it in plan, design and transition, and obtain/build.
- Identify assets, threats, vulnerabilities and existing controls. Assess likelihood and impact against agreed criteria and risk appetite.
- Treat by avoiding, reducing, transferring or accepting. Record the owner, treatment plan, residual risk and review date.
- Use the risk management practice for method; information security management owns security risk content. Supplier management, service continuity management and problem management supply inputs.
- Follow keep it simple and practical: a clear qualitative method used consistently beats an unused quantitative model.
Worked example
A cloud migration moves customer PII. The threat is misconfigured storage; the vulnerability is no automated configuration check. Likelihood is medium and impact high, so the risk is above appetite. Treatment adds policy-as-code guardrails, encryption, least-privilege IAM, a supplier contractual control and monitoring. The owner accepts the residual risk. Reasoning: assess before treating, reassess after, and record acceptance so the decision is auditable.
Traps that cost marks
- Running risk assessment as a one-time checklist.
- Scoring risk without comparing it to appetite.
- Ignoring third-party and supplier risk.
- Recording only technical vulnerabilities and missing process or people risks.
- Not documenting accepted residual risk and its owner.
- Confusing a risk with an incident or an issue.