Fundamental concepts and principles of information security risk management
Domain 1 - Fundamental concepts and principles
This domain tests whether you can use risk language like an ISO practitioner, not a vendor. It probes the difference between uncertainty, risk, threat, vulnerability and control, and whether you understand that risk management is decision support tied to objectives.
Core rules
- Risk is the effect of uncertainty on objectives; for information security the objectives are confidentiality, integrity and availability (CIA), plus related obligations.
- Information security risk is usually analysed as a combination of the likelihood of a threat event and its consequences. A product formula is a convention, not the definition.
- A threat is a potential source of harm; a vulnerability is a weakness that can be exploited; a control modifies likelihood or consequence. None of these is itself the risk.
- Risk is assessed against criteria and owned by a risk owner with authority to accept it. Residual risk remains after treatment.
- ISO 31000 principles - integrated, structured and comprehensive, customised, inclusive, dynamic, based on best available information, considering human and cultural factors, and continually improved - underpin ISO/IEC 27005:2022.
Worked example
A SaaS provider considers account takeover. Threat: credential stuffing. Vulnerability: password-only login. Consequence: fraudulent transactions and reputational damage. The team rates likelihood high and consequence medium, giving a high inherent risk. Adding MFA changes likelihood to low; residual risk falls to medium, inside the stated tolerance. The risk owner records acceptance. Reasoning: the treatment changes likelihood, not consequence; the score is not the decision - the criteria and owner authority make it one.
Traps
Treating a vulnerability scan finding as a risk; accepting residual risk before treatment; confusing risk appetite with tolerance; ignoring accidental and environmental threats; assuming ISO/IEC 27005 is certifiable.