Risk Identification and Asset Inventory
Domain 2 tests whether you can find risk before scoring it. The exam emphasizes asset inventories, classification, threat and vulnerability identification, and structured techniques.
Core rules
- An asset is anything of value: data, systems, people, facilities, intellectual property, brand, and supplier relationships.
- A usable inventory records owner, location, criticality, classification, and dependencies; an asset without an owner is effectively unmanaged.
- Identify threats (who or what can cause harm), vulnerabilities (weaknesses that a threat can exploit), and existing controls separately.
- Techniques include process mapping, data-flow diagrams, interviews, workshops, checklists, threat modeling, scenario analysis, and Delphi rounds.
- Risk registers should capture cause, event, consequence, affected assets, and current controls, not just a label.
Worked example
A hospital inventories infusion pumps. The asset record shows 400 pumps on a clinical VLAN, firmware version 3.2, owned by biomedical engineering, supporting medication delivery. Threat modeling identifies remote exploitation of default credentials; the vulnerability is unpatched firmware plus shared passwords. The consequence is incorrect dosing, patient harm, and regulatory reporting. Because the pump is linked to a life-safety process, criticality is high even though the device's data classification is low. The reasoning connects asset attributes to a credible threat path, not just a list of devices.
Traps
- Inventorying hardware but omitting data, identities, and third-party services.
- Confusing a threat (a ransomware group) with a vulnerability (an unpatched server).
- Recording criticality without a business-impact basis.
- Running identification once instead of updating it when architecture changes.