Risk Management and Compliance
Domain 7 tests risk-based decisions and the limits of compliance. Topics include risk assessment, likelihood and impact, inherent versus residual risk, control selection, treatment options, third-party risk, business impact analysis, RTO, RPO, and evidence.
Core rules
- Risk is commonly assessed as likelihood and impact against defined criteria. Qualitative ratings need a rationale, not just a color.
- Inherent risk exists before controls; residual risk remains after controls. A control that is not tested may not reduce risk as assumed.
- Treatment options are avoid, mitigate, transfer, and accept. Acceptance belongs to an accountable owner and should include expiry and review.
- Compliance is meeting a requirement; security is managing risk. A compliant system can still be exposed.
- BIA identifies critical processes and dependencies. RTO is the target time to restore; RPO is the acceptable data loss window.
Worked example
A legacy server cannot be patched because a vendor denies support. The team documents the vulnerability, applies network isolation and strict access as compensating controls, increases monitoring, and records residual risk with an owner and review date. The reasoning is not to pretend the risk is gone; it is to reduce exposure, detect exploitation, and make the remaining risk explicit for a decision-maker.
Traps
Do not equate a completed checklist with acceptable risk. Do not ignore residual risk after a compensating control. Do not assign risk acceptance to someone without authority.