Information Security Risk Management Approaches and Processes
What Domain 2 tests
This domain tests the end-to-end process and the identification approaches. Expect questions on the order of steps, the four treatment options, and the documents produced.
The process
- Establish context - define scope, risk criteria (acceptance thresholds, impact and likelihood scales) and roles.
- Risk identification - find assets, threats, vulnerabilities, existing controls and consequences. Three recognised approaches: asset-based, event-based and vulnerability-based.
- Risk analysis - assign consequences and likelihood, then derive a risk level using a qualitative, semi-quantitative or quantitative method.
- Risk evaluation - compare levels with criteria to decide which risks need treatment and in what priority.
- Risk treatment - choose modification, retention, avoidance or sharing; select controls from ISO/IEC 27002, build a risk treatment plan, and have the risk owner accept residual risk.
- Communication and consultation, monitoring and review - run continuously alongside the steps above.
Documentation
A risk register records asset, threat, vulnerability, existing controls, likelihood, consequence, risk level, owner, treatment and residual risk. ISO/IEC 27001 Clause 6.1.3 also requires a Statement of Applicability justifying inclusion or exclusion of each Annex A control.
Worked example
An online shop sets an acceptance threshold of 10. Event-based identification surfaces "payment card breach". Analysis: likelihood 4 (internet-facing, prior scanning), consequence 5 (fines, brand damage) = 20, well above threshold. Evaluation: treat first. Treatment: modification via tokenisation and network segmentation; residual 8, below threshold, accepted by the risk owner and tracked with a quarterly monitoring metric.
Traps
- Jumping straight to controls without risk evaluation.
- Using the wrong treatment vocabulary - 27005 says modification, retention, avoidance, sharing.
- Assuming sharing transfers accountability; it does not.
- Omitting the Statement of Applicability or leaving residual risk unaccepted.