Risk Management
What this domain tests
Risk management tests whether you can identify, analyze, treat, and monitor information security risk in a repeatable way. Expect questions on risk criteria, assessment methods, treatment options, ownership, residual risk, and third-party risk.
Core rules
- ISO 31000 and the NIST Risk Management Framework both require context and criteria before scoring; a score without defined scales is not comparable.
- Qualitative methods use likelihood and impact ratings; quantitative methods use monetary loss, annualized loss expectancy, or simulation.
- Risk treatment options are avoid, mitigate, transfer, or accept. Transfer through insurance or contract does not remove accountability.
- Every risk needs an owner with authority to accept or fund treatment. Inherent risk exists before controls; residual risk remains after controls.
- Monitoring is continuous: changes in assets, threats, suppliers, or law can shift the rating.
Worked example
A SaaS vendor stores customer PII. The team identifies unauthorized access due to a weak vendor patch process. Likelihood is rated 4/5 because the vendor had a recent vulnerability; impact is 5/5 because breach notification and regulatory fines are likely. Inherent score is 20/25, above the 12 threshold. Treatment: require the vendor to provide SOC 2 Type II evidence, contract a 72-hour notification clause, and limit data fields. Residual likelihood falls to 2, score 10, accepted by the business owner. Reasoning: the score follows defined criteria, the treatment changes likelihood, and the owner accepts the remaining risk.
Traps
- Building a risk register with no owners or review dates.
- Scoring risks before agreeing scales and thresholds.
- Assuming encryption eliminates risk rather than reducing it.
- Treating vendor contracts as complete risk transfer.
- Recording only residual risk and losing the rationale.