CISRM cheat sheet

Risk = effect of uncertainty on objectives; ISO 31000 expresses it as likelihood of events multiplied by their consequences, and treats risk as having both upside and downside.

Risk appetite = amount and type of risk an organization is willing to pursue or retain; risk tolerance = the acceptable variation around that appetite; risk capacity = maximum risk it can bear before breaching objectives.

Inherent risk is measured before controls; residual risk after controls; target risk is the level management chooses to pursue. Control effectiveness = (inherent − residual) ÷ inherent.

Three lines model: first line owns and manages risk in operations; second line provides oversight, frameworks, and challenge; third line (internal audit) gives independent assurance to the governing body.

ISO 31000 process sequence: scope/context → risk identification → analysis → evaluation → treatment → monitoring and review, with communication and consultation throughout.

COSO ERM components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication, and reporting.

Board-level risk governance requires an approved risk appetite statement, defined risk owners, escalation thresholds, and periodic reporting of residual risk against appetite.

Risk owner = accountable person for managing a risk and its treatment; risk action owner = person executing specific treatment tasks. Ownership is distinct from custody of the control.

Asset inventory scope: hardware, software, data, people, facilities, services, and third parties; each asset needs a unique identifier, owner, classification, and location.

Identification techniques: workshops, interviews, process walkthroughs, checklists and taxonomies, SWOT, HAZOP, scenario analysis, incident post-mortems, and loss-data review.

Risk statement structure: cause → event → consequence, tied to a specific objective; a vague label such as "cyber risk" is not an identified risk.

Data classification tiers (e.g., public, internal, confidential, restricted) drive handling, retention, and control requirements; classification must be recorded in the inventory.

Dependency mapping identifies upstream suppliers, downstream customers, and internal service chains so that a single failure's blast radius is visible.

Asset criticality scoring combines business process impact, data sensitivity, and recovery requirements (RTO/RPO) to prioritize protection.

Configuration management database (CMDB) or asset register is the authoritative source; stale or unowned assets are themselves a reportable risk.

Threat intelligence, vulnerability scan results, and audit findings feed the identification stage; unidentified risks cannot be analyzed or treated.

Risk score = likelihood × impact (or probability × consequence); qualitative scales (e.g., 1–5) must have documented definitions for each level.

Quantitative analysis: ALE = SLE × ARO, where SLE = asset value × exposure factor; ARO is annualized rate of occurrence.

Expected loss and loss exceedance curves express risk in monetary terms; value at risk (VaR) is a percentile of the loss distribution over a defined period.

Bow-tie analysis separates threats and causes on the left from consequences on the right, with preventive and mitigating controls on the respective paths.

FAIR decomposes risk into frequency (threat event frequency × vulnerability) and magnitude (primary and secondary loss); Monte Carlo simulation yields a distribution, not a point estimate.

FMEA scores severity × occurrence × detection (RPN); HAZOP uses guide words on process parameters; fault tree analysis is deductive, event tree analysis is inductive.

Qualitative vs. semi-quantitative vs. quantitative: choice depends on data availability, decision stakes, and required precision; document assumptions and confidence.

Correlation and aggregation matter: summing individual risk scores overstates or understates portfolio risk when risks share common causes.

Evaluation compares analysis results against risk criteria (appetite, tolerance, regulatory limits) to decide: accept, treat, transfer, avoid, or exploit.

Risk matrix design: avoid too few cells and inconsistent scales; a 5×5 matrix with defined thresholds is common, but color bands must map to explicit numeric ranges.

Prioritization ranks by residual risk score, but also weighs velocity (speed to impact), persistence, and concentration of exposure.

Risk aggregation: total portfolio exposure is not the arithmetic sum of individual risks; dependencies and shared controls change the aggregate.

Risk ranking must be revisited when controls change, threats evolve, or business context shifts; a static register drifts from reality.

Cost-benefit of treatment: compare ALE reduction against control cost; a control is justified when expected loss reduction exceeds its total cost of ownership.

Risk appetite thresholds act as escalation triggers; risks above tolerance require documented acceptance by an accountable executive or the board.

Documented rationale for accept/avoid decisions is evidence for auditors and regulators; undocumented acceptance is a governance gap.

Treatment options: avoid (eliminate activity), reduce/mitigate (controls), transfer/share (insurance, contracts), accept (retain), and exploit (pursue upside).

Control types: preventive, detective, corrective, deterrent, and compensating; layered defense (defense in depth) reduces single-point failure.

ISO 27001 Annex A control themes: organizational, people, physical, and technological; map each selected control to the risk it treats.

Residual risk after treatment must be re-evaluated and formally accepted; treatment plans need owner, due date, and success criteria.

Control effectiveness testing: design effectiveness (is it built correctly?) vs. operating effectiveness (does it work over time?); both are needed.

Compensating controls are used when a primary control is infeasible; they must provide equivalent risk reduction and be documented as such.

Insurance transfers financial consequence, not the probability of the event; contractual transfer shifts liability but not reputational or regulatory exposure.

Statement of applicability (SoA) records which controls are applied, excluded, and why - a key artifact for certification and audit.

Key risk indicators (KRIs) are leading metrics with defined thresholds (green/amber/red) and owners; they should be predictive, not just historical.

Risk register fields: ID, description, cause, consequence, owner, inherent score, controls, residual score, treatment plan, status, review date.

Reporting cadence: operational dashboards (continuous/weekly), management reporting (monthly/quarterly), board reporting (quarterly/annual) with trend and appetite comparison.

Monitoring sources: control testing results, incident and near-miss data, audit findings, KRI breaches, external threat intelligence, and regulatory changes.

Escalation criteria must be explicit: threshold breach, emerging risk, repeated control failure, or material change in business context.

Risk communication must be tailored to audience - board wants exposure vs. appetite and trends; operators need actionable control status.

Post-incident reviews update the register; lessons learned close the loop between monitoring and identification.

Metrics should be auditable: define data source, calculation method, and owner for every KRI to avoid gaming or ambiguity.

Third-party lifecycle: due diligence → contract and controls → onboarding → ongoing monitoring → offboarding and data return/destruction.

Tiering by criticality: classify vendors by data sensitivity, system access, and business dependency; higher tiers require deeper assessment and more frequent review.

Due diligence artifacts: security questionnaires, certifications (ISO 27001, SOC 2 Type II), financial health, insurance, and subprocessor disclosure.

Contract clauses: right to audit, breach notification timelines, data protection and residency, subcontractor approval, termination and transition assistance, liability caps.

Concentration risk: over-reliance on a single supplier or region creates correlated failure; map fourth-party (subprocessor) dependencies.

Ongoing monitoring: periodic reassessment, continuous security rating feeds, SLA/performance reviews, and monitoring of vendor incidents and breaches.

Supply chain attacks target software and hardware provenance; controls include SBOM, vendor attestations, and integrity verification.

Exit planning: ensure data portability, escrow where appropriate, and tested transition to avoid lock-in and service disruption.

Regulatory obligations vary by jurisdiction and sector; map each obligation to a control and an owner to demonstrate compliance.

GDPR principles: lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, accountability.

Data subject rights (access, rectification, erasure, portability, objection) and breach notification timelines (e.g., GDPR 72 hours to supervisory authority) drive operational requirements.

Records retention schedules must reflect legal, regulatory, and contractual minimums and maximums; over-retention increases legal and privacy risk.

Contract law allocates risk: indemnities, limitation of liability, warranties, and service levels shift financial consequence between parties.

Compliance frameworks (ISO 27001, NIST CSF, SOC 2, PCI DSS, HIPAA) provide control baselines; certification is evidence, not a guarantee of security.

Regulatory change management: monitor, assess impact, update controls and policies, and evidence the change for audit.

Legal privilege and evidence handling: preserve logs and chain of custody for investigations; spoliation can create liability.

BIA outputs: critical business processes, dependencies, RTO (recovery time objective), RPO (recovery point objective), and MTD (maximum tolerable downtime).

RTO is the target restore time; RPO is the acceptable data loss measured in time; MTD is the hard limit before unacceptable harm.

BCP strategies: hot/warm/cold sites, replication, failover, manual workarounds; strategy choice balances cost against RTO/RPO.

Incident response lifecycle: preparation → detection and analysis → containment, eradication, recovery → post-incident activity (lessons learned).

Incident severity classification drives escalation, notification, and resource allocation; define criteria for each severity level.

Crisis communication: pre-approved templates, spokesperson roles, and regulatory/customer notification obligations.

Testing: tabletop exercises, simulation, and full failover tests validate plans; untested plans are assumptions, not controls.

Plan maintenance: review after major changes, incidents, or at defined intervals; version control and training records are audit evidence.