Security and Risk Management
The Security and Risk Management domain tests how security strategy aligns with business objectives, how risk is quantified and treated, and how policy, continuity, and compliance are governed. Expect questions on risk formulas, control types, policy hierarchy, BCP metrics, and professional conduct.
Core rules and concepts
- Risk = likelihood × impact. SLE = asset value × exposure factor. ALE = SLE × annualized rate of occurrence (ARO). Control value = ALE before − ALE after − control cost.
- Risk responses: avoid, mitigate, transfer, accept. Residual risk remains after controls; total risk is before controls.
- Policy hierarchy: policy (intent) → standard (mandatory requirement) → procedure (steps) → guideline (recommendation). Senior management approves policies.
- BCP metrics: RTO is maximum tolerable downtime for a process; RPO is acceptable data loss measured in time; MTD is maximum tolerable downtime before unacceptable harm; MTBF and MTTR describe reliability and repair.
- Due care is acting on risk; due diligence is verifying and documenting it.
Worked example
An asset is valued at $200,000, exposure factor is 25%, and ARO is 0.4. SLE = $200,000 × 0.25 = $50,000. ALE = $50,000 × 0.4 = $20,000. A control costs $8,000 and reduces ARO to 0.1. New ALE = $50,000 × 0.1 = $5,000. Savings = $20,000 − $5,000 = $15,000. Net benefit = $15,000 − $8,000 = $7,000, so the control is financially justified. If the control cost $18,000, net benefit would be negative and acceptance or another control should be considered.
Traps
Confusing ARO with probability; mixing RTO and RPO; treating residual risk as total risk; assuming a policy is a procedure; and forgetting that risk acceptance must be documented by the accountable owner.