ISO/IEC 27005 Lead Risk Manager key terms

The potential for loss or harm to an organization's information and supporting assets, expressed as a combination of the likelihood of a threat event and its consequences.

The effect of uncertainty on objectives, where the effect is a deviation from what is expected and can be positive or negative. In security contexts, usually the negative combination of likelihood and consequence.

Anything that has value to the organization, including information, hardware, software, services, people, and reputation. Assets are what risk management seeks to protect.

A specific body of information or data, in any form, that is valuable to the organization and therefore requires protection throughout its lifecycle.

The accountable person or role with authority over a specific asset who is responsible for its classification, protection requirements, and acceptance of risk relating to it.

A potential cause of an unwanted incident that may result in harm to a system or organization, such as an attacker, malware, or a natural event.

The actor or circumstance that can exploit a vulnerability, whether intentional (an adversary), accidental (a careless employee), or environmental (flood, fire).

A weakness in an asset or control that can be exploited by one or more threats, thereby increasing the likelihood or impact of an unwanted event.

A qualitative or quantitative estimate of how probable it is that a threat will exploit a vulnerability and cause an incident within a defined period.

The outcome or impact of an event on objectives, assets, or stakeholders, often assessed in terms of financial loss, operational disruption, legal exposure, or reputational damage.

The magnitude of harm or loss resulting from an information security incident, evaluated against criteria such as financial, operational, legal, and reputational consequences.

The level of risk that exists before any controls or mitigations are applied, used as a baseline to understand exposure and the value of proposed treatment.

The risk that remains after controls have been implemented and treatment has been applied, which must be compared against the risk acceptance criteria.

Coordinated activities to direct and control an organization with regard to risk, encompassing identification, analysis, evaluation, treatment, and ongoing monitoring.

The systematic, iterative set of activities, from context establishment through monitoring and review, by which an organization manages information security risk.

The set of policies, procedures, roles, and structures that together provide the foundations and arrangements for embedding risk management across an organization.

The terms of reference against which the significance of risk is evaluated, including thresholds, appetite, and the level at which risks require treatment or escalation.

The amount and type of risk that an organization is willing to pursue or retain in order to meet its objectives, often expressed qualitatively or quantitatively.

The acceptable variation or deviation from the risk appetite that an organization is prepared to withstand before action is required.

The first stage of the risk management process, defining external and internal parameters, scope, risk criteria, and the boundaries within which risk is assessed.

The defined boundary of the risk assessment, specifying which organizational units, systems, assets, and processes are included or excluded from analysis.

The process of finding, recognizing, and describing risks, including their sources, events, causes, and potential consequences, to build a register of risks.

A structured record of identified risks, their owners, assessments, treatment decisions, and status, used to track and communicate risk across the organization.

The process of comprehending the nature of a risk and determining its level by combining estimates of likelihood and consequence, often with consideration of existing controls.

An assessment approach that describes risk using descriptive scales such as low, medium, or high, useful where numerical data is unavailable or precision is unnecessary.

An assessment approach that assigns numerical values to likelihood and impact, often expressed in monetary terms such as annualized loss expectancy.

The magnitude of a risk expressed as the combination of likelihood and consequence, used to compare risks and prioritize them for treatment.

A tool that plots likelihood against consequence on a grid to derive risk levels and support consistent comparison and prioritization of risks.

The process of comparing the results of risk analysis against risk criteria to determine whether a risk is acceptable or requires treatment.

The process of selecting and implementing measures to modify risk, typically by avoiding, reducing, transferring, or retaining it, and then verifying the effect.

A treatment option that lowers the likelihood or impact of a risk through controls such as preventive measures, detection capabilities, or corrective actions.

A treatment option that shifts the financial or contractual consequences of a risk to another party, for example through insurance or outsourcing agreements, without eliminating the risk itself.

A treatment option that eliminates a risk by deciding not to undertake the activity that generates it, or by removing the vulnerable asset or process entirely.

A measure that modifies risk, including policies, procedures, technical safeguards, and organizational practices, which should be monitored for effectiveness.

The informed decision by an authorized party to retain a risk without further treatment, based on a documented rationale and within agreed risk criteria.

The person or role accountable for managing a particular risk, including approving its treatment and accepting residual risk within delegated authority.

The ongoing exchange of information about risk between the organization and its stakeholders, supporting informed decisions and shared understanding of exposure.

A structured dialogue with stakeholders to obtain their views and input on risk analysis and treatment decisions before decisions are finalized.

The continuing oversight of risks, controls, and the risk management process to detect changes, verify effectiveness, and identify improvements over time.

A document listing the information security controls selected as relevant, with justification for inclusion or exclusion, linking risk treatment outcomes to the management system.