Risk management: assessment, treatment, controls and monitoring

Risk management is the core of Domain 1 and, arguably, of the whole CISSP. Sub-domain 1.9 covers threat and vulnerability identification, risk analysis and assessment, risk response and treatment (including cyber insurance), types of controls, control assessments, continuous monitoring, reporting, continuous improvement and risk frameworks. This lesson builds the vocabulary and the calculations you need, then shows how the pieces fit into a cycle that keeps risk within the organization's appetite.

The vocabulary of risk

An asset is anything of value to the organization: information, systems, people, facilities, reputation. A threat is a potential cause of an unwanted incident, such as a ransomware group, a careless employee or a flood. A threat agent or threat actor is the entity that carries out the threat. A vulnerability is a weakness that a threat could exploit, such as an unpatched server or untrained staff. Exposure is being susceptible to loss from a threat. Risk is the likelihood that a threat will exploit a vulnerability, combined with the impact if it does. A safeguard or control reduces risk. Residual risk is the risk that remains after controls are applied; inherent risk is the risk before controls.

A simple way to remember the relationship is that risk exists where threats, vulnerabilities and valuable assets meet. Remove any one, for example by patching the vulnerability or not holding the asset, and that risk largely disappears. Total risk is sometimes written conceptually as threats × vulnerabilities × asset value, and residual risk as total risk minus the effect of controls, sometimes with a 'controls gap' term. These are conceptual statements rather than formulas to compute.

Identifying threats and vulnerabilities

Risk identification starts with an asset inventory and asset valuation, then asks what could go wrong. Sources include threat intelligence (reports from national cyber centres, industry groups and vendors), incident history, vulnerability scans and penetration tests, audit findings, interviews with business owners, and frameworks such as MITRE ATT&CK, which catalogues attacker tactics and techniques. Threat modelling (Lesson 12) structures this thinking for specific systems. The output is a risk register: a list of risks, each with a description, owner, likelihood, impact, existing controls, rating and planned treatment.

Risk assessment: scope and approach

Before assessing, define the scope (which systems, processes or business units), the criteria (scales for likelihood and impact, and the organization's risk appetite), and the approach. Risk assessments can be qualitative, quantitative or semi-quantitative. NIST SP 800-30 and ISO/IEC 27005 describe the process in detail.

Qualitative assessment rates likelihood and impact on descriptive scales, such as low, medium and high or 1 to 5, often plotted on a heat map. It is fast, easy to understand and useful when data is scarce, but subjective, and ratings are hard to compare or add up. Techniques such as the Delphi method, in which experts give anonymous estimates over several rounds until they converge, can reduce bias.

Quantitative assessment assigns monetary values and probabilities. It supports cost-benefit decisions and communicates in the language of executives, but needs data that is often unavailable and can give a false sense of precision. Semi-quantitative approaches assign numeric scores to qualitative scales. Models such as FAIR (Lesson 3) use ranges and simulation to give quantitative answers with honest uncertainty.

Quantitative risk calculations

The classic quantitative formulas appear on the exam and in practice:

The single loss expectancy (SLE) is the expected loss from one occurrence of a threat. Asset value (AV) is the value of the asset, and exposure factor (EF) is the percentage of that value lost in one occurrence.

The annualized loss expectancy (ALE) is the expected yearly loss. The annualized rate of occurrence (ARO) is how many times per year the threat is expected to occur; an event expected once every ten years has an ARO of 0.1.

A safeguard is cost-justified when its value is positive: it reduces expected annual losses by more than it costs each year. The annual cost should include purchase (spread over its useful life), implementation, maintenance, staff time and any productivity impact.

Qualitative scoring

Qualitative assessments are more common in practice. A typical scheme rates likelihood and impact from 1 (very low) to 5 (very high), multiplies them for a score from 1 to 25, and maps scores to bands such as low (1 to 4), medium (5 to 9), high (10 to 16) and critical (20 to 25). Each band has a required response: critical risks must be treated immediately and reported to executives; low risks may be accepted by the risk owner.

Risk response and treatment

Once risks are assessed, each needs a response decided by its owner within the organization's appetite and tolerance. The four classic responses are:

• Mitigate (reduce): apply controls to lower likelihood or impact, such as patching or adding multi-factor authentication.
• Transfer (share): shift some financial impact to another party, through cyber insurance or contracts. Accountability for protecting data is not transferred.
• Avoid: stop the activity that creates the risk, such as not launching a product in a market with unacceptable legal exposure, or not collecting certain data.
• Accept: knowingly retain the risk because treatment costs more than the expected loss or the risk is within appetite. Acceptance should be formal, documented and made by someone with authority.

Ignoring or rejecting a risk, pretending it does not exist, is not a valid response. Risk appetite is the amount of risk the organization is willing to pursue to achieve its objectives; risk tolerance is the acceptable variation around specific objectives; risk capacity is the most risk it could bear without failing. Many organizations express appetite in board-approved statements, such as 'no tolerance for breaches of customer payment data' or 'moderate appetite for innovation risk in new digital services'.

Types of controls

Controls are classified in two dimensions. By category: administrative (or managerial) controls such as policies, training and background checks; technical (or logical) controls such as encryption, firewalls and access control software; and physical controls such as locks, fences and guards. By function: preventive controls stop incidents (locks, access control); detective controls find them (logs, intrusion detection, audits); corrective controls fix problems after detection (restoring from backup, patching); deterrent controls discourage attempts (warning banners, visible cameras); recovery controls restore operations (disaster recovery sites); directive controls tell people what to do (policies, signs); and compensating controls provide alternative protection when a primary control is not feasible.

Assessing controls and monitoring risk

Controls must be tested to confirm they are designed well and operate effectively. Control assessments include self-assessments, internal audits, external audits, vulnerability scans, penetration tests and specific privacy assessments. NIST SP 800-53A provides assessment procedures for SP 800-53 controls. Results feed the risk register: a control that fails testing means residual risk is higher than assumed.

Risk changes constantly, so monitoring must be continuous rather than annual. Continuous monitoring uses automated tools, key risk indicators and periodic reassessment to track changes in threats, vulnerabilities, assets and control effectiveness. Reporting goes both internally, to risk owners, executives and the board, and externally, to regulators, auditors, customers and, for public companies, investors. Continuous improvement uses lessons from incidents, audits and changes to strengthen the program over time, and risk maturity models help measure progress from ad hoc to optimized risk management.

Risk assessment results are only as good as their inputs, so assessors should record their assumptions and sources and revisit estimates when new information arrives. Presenting ranges, such as an ALE between $120,000 and $300,000, is often more honest than a single figure and helps leaders understand uncertainty.