ISO/IEC 27005 Lead Risk Manager flashcards
ISO/IEC 27005 Lead Risk Manager · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Information security risk
- The effect of uncertainty on information security objectives, usually expressed as a combination of the likelihood of a threat event and its consequence for the organization.
- Risk owner
- The person or entity accountable for managing a specific risk, including approving treatment and accepting residual risk within their authority.
- Residual risk
- The risk remaining after risk treatment controls have been implemented and assessed; it must be compared with risk criteria and formally accepted if above threshold.
- Risk appetite
- The amount and type of risk an organization is willing to pursue or retain in pursuit of its objectives, usually expressed through qualitative or quantitative statements.
- Risk tolerance
- The acceptable deviation from risk appetite for a specific objective or activity, often expressed as a threshold or limit that triggers action.
- Risk treatment options
- The four standard responses to risk: modify by applying controls, retain by accepting, avoid by eliminating the activity, or share by transferring to another party.
- ISO/IEC 27005 purpose
- It provides guidance on managing information security risk, supporting ISO/IEC 27001, and describes a process for context, identification, analysis, evaluation, treatment, and monitoring.
- ISO/IEC 27005 structure
- The standard organizes risk management into context establishment, risk identification, analysis, evaluation, treatment, acceptance, and continuous communication and monitoring activities.
- Asset-based risk identification
- A method that starts by inventorying information assets, their owners, and value, then identifies threats and vulnerabilities affecting each asset.
- Event-based risk identification
- A method that starts from threat events or scenarios and traces their causes and consequences to affected assets and business processes.
- Risk criteria
- The terms of reference against which the significance of risk is evaluated, including impact and likelihood scales, risk matrix, and acceptance thresholds.
- ISO/IEC 27001 clause 6.1.2
- Requires an information security risk assessment process with defined criteria that produces consistent, valid, and comparable results, and is retained as documented information.
- ISO/IEC 27001 clause 6.1.3
- Requires a risk treatment process, selection of controls, comparison with Annex A, a Statement of Applicability, and approval of residual risk by risk owners.
- Statement of Applicability
- A document listing each Annex A control, whether it is applicable, the justification for inclusion or exclusion, and its implementation status.
- Clause 8.2 risk assessment
- Requires performing risk assessments at planned intervals or when significant change occurs, using the criteria defined in clause 6.1.2.
- Clause 9.1 monitoring
- Requires monitoring, measurement, analysis, and evaluation of information security performance, including the effectiveness of risk assessment and treatment.
- Context establishment
- The process of defining external and internal issues, scope, stakeholders, constraints, and risk criteria that shape the risk management process.
- Scope definition
- Identification of organizational units, locations, processes, assets, and system boundaries covered by the risk assessment, recorded to make results comparable.
- Impact criteria
- Categories and scales used to evaluate consequences of a risk event, such as confidentiality, integrity, availability, legal, financial, reputational, and safety impacts.
- Stakeholder identification
- Determining interested parties and their requirements, expectations, and influence relevant to information security risk, including regulators, customers, and suppliers.
- Risk identification
- The process of finding, recognizing, and describing risks, including sources, events, causes, and potential consequences, using systematic and repeatable methods.
- Risk analysis
- The process of determining the nature and level of risk by assessing consequences and their likelihood, using qualitative, semi-quantitative, or quantitative methods.
- Annualized loss expectancy
- ALE equals single loss expectancy multiplied by annualized rate of occurrence; it estimates expected yearly financial loss from a risk event.
- Single loss expectancy
- SLE equals asset value multiplied by exposure factor; it estimates the financial loss from a single occurrence of a risk event.
- Qualitative risk analysis
- Analysis using ordinal descriptive scales such as low, medium, and high, useful when data is limited but less precise for financial decisions.
- Quantitative risk analysis
- Analysis using numeric and monetary values and probabilities, enabling cost-benefit comparison of treatment options but requiring reliable data.
- Risk evaluation
- The process of comparing risk analysis results with risk criteria to decide whether the risk is acceptable and whether treatment is required.
- Risk prioritization
- Ranking risks by level and business impact against criteria, so treatment resources are directed to the most significant risks first.
- Risk treatment plan
- A documented plan defining treatment actions, responsible parties, resources, timelines, and expected residual risk for identified risks.
- Risk acceptance
- A documented management decision by the risk owner to retain a risk, with rationale and date, when residual risk is within the defined criteria.
- Risk communication
- Continuous planned exchange of risk information with stakeholders so they understand risk, decisions, and treatment status in a timely and accurate way.
- Monitoring and review
- Continuous activities that track changes in context, risk levels, control effectiveness, and treatment progress, feeding results back into the risk management process.