Risk management frameworks

Kettle & Crumb Bakery's owner, Anneliese Vogt, had a question that Owen Larkin passed to Keisha in early November. Her insurer had sent a cyber insurance renewal form with forty questions, and her bank had asked whether the bakery's card terminals met the payment card industry's security standard. She wanted to know, in plain words, how much risk the bakery was carrying and what it would cost to reduce it. Keisha asked Jordan to help her build the bakery's first risk register. Risk management, she told him, is how security stops being a list of scary technical things and becomes a set of business decisions that an owner can actually make.

This lesson explains what risk is and how it is measured, the choices an organization has for dealing with each risk, and the frameworks that help organizations of every size manage risk in a consistent way. It ends with the register Keisha and Jordan built.

What risk is

Lesson 4 defined risk as the combination of a threat exploiting a vulnerability and the impact that follows. Risk management turns that idea into a repeatable process: identify what you need to protect, identify what could go wrong, estimate how likely and how harmful each event would be, decide what to do about it, and keep checking as things change. The assets involved are not only devices. For the bakery they included card payments, the online ordering site, the recipes and supplier pricing in the office laptop, employee payroll records and the bakery's reputation in a small city.

Two terms describe how much risk an organization is willing to carry. Risk appetite is the broad amount of risk an organization is willing to accept in pursuit of its goals. Risk tolerance is the acceptable variation around a particular objective, often expressed as a limit, such as the longest time the shops can operate without card payments. Owners set appetite and tolerance; technicians help them understand what those choices mean.

Qualitative risk assessment

Most small organizations assess risk qualitatively, using ratings rather than dollar figures. Each risk is rated for likelihood and impact on a simple scale, often 1 to 5, and the two ratings are multiplied to give a risk score. The scores can then be plotted on a risk matrix, sometimes called a heat map, where the top-right corner holds the risks that need attention first.

Qualitative ratings are quick and easy to discuss, but they depend on judgment. Two people may rate the same risk differently. Keisha reduced that problem by writing down what each rating meant for the bakery. An impact of 5 meant losing the ability to take payments in all three shops for more than a day or a breach of customer card data. An impact of 1 meant a nuisance fixed in under an hour. A likelihood of 5 meant it was expected within the year; a likelihood of 1 meant it was unlikely in the next five years.

Quantitative risk assessment

Quantitative assessment puts numbers on risk in money. It is used where good data exist, such as insurance, and it is a favourite of exam questions because the formulas are simple.

• Asset value (AV) is what the asset is worth, including the cost of replacing it and the income it supports.
• Exposure factor (EF) is the fraction of the asset's value lost in one event.
• Single loss expectancy (SLE) is the expected loss from one event: SLE = AV × EF.
• Annualized rate of occurrence (ARO) is how many times the event is expected per year. Once every four years is an ARO of 0.25.
• Annualized loss expectancy (ALE) is the expected loss per year: ALE = SLE × ARO.

The ALE gives a rough ceiling on what it makes sense to spend each year to reduce a risk. If a control costs more per year than the loss it prevents, it may not be worth buying, although reputation and legal duties can change that calculation.

Treating risk

Once a risk is understood, there are four standard ways to treat it, and the exam expects you to know them.

• Mitigate, also called reduce: apply controls that lower the likelihood or impact, such as patching, multi-factor authentication or backups.
• Transfer, also called share: shift some of the financial impact to someone else, usually through insurance or a contract with a supplier.
• Avoid: stop the activity that creates the risk, such as no longer storing card numbers at all.
• Accept: knowingly live with the risk because it is low or the cost of treating it is too high. Acceptance must be approved by someone with authority and reviewed regularly.

Most risks are treated with a combination. The bakery reduced the risk of card data theft by moving to point-of-sale terminals that encrypt card data from the moment a card is tapped, transferred part of the remaining financial risk through cyber insurance and accepted the small leftover risk in writing. The risk that remains after treatment is called residual risk, and it is the residual risk that the owner accepts. Insurance transfers money, not responsibility: if customer data is stolen, the bakery still has to notify people and deal with its reputation.

Frameworks that guide the work

A framework is a structured set of practices that helps an organization manage cybersecurity risk consistently and explain its approach to others. The CCST exam expects familiarity with the main ones and with how compliance frameworks shape what an organization must do.

The NIST CSF is the one most often discussed in small and medium organizations, including in Canada. Version 2.0, released in February 2024, added the Govern function to stress that cybersecurity is a leadership responsibility, not just a technical one. Each function breaks down into categories and subcategories that an organization can use to describe its current state, set a target state and plan the gap between them. The CIS Controls are more concrete: they say what to do first, such as keeping an inventory of devices and software, which is exactly where Lesson 4 started.

Compliance frameworks

Some frameworks are voluntary. Others are required by law, regulation or contract, and those are called compliance frameworks. Their requirements shape how an organization protects data and how it must respond to incidents, which Lesson 9 covers.

• PCI DSS applies to anyone who handles payment card data. Small merchants like the bakery usually prove compliance with a self-assessment questionnaire each year. Version 4.0 became the only active version in 2024, and its newer requirements took effect on March 31, 2025.
• Privacy laws such as the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's private-sector privacy law and provincial health information acts require reasonable safeguards for personal information and set breach-reporting duties.
• Professional rules can also apply. Riverside Family Law's lawyers have a professional duty to protect client confidentiality, set by their provincial law society, which includes taking reasonable care with technology.
• The European Union's General Data Protection Regulation can apply to North American businesses that offer goods or services to people in the EU.

The risk register

A risk register is the document where risks are recorded, rated, assigned and tracked. It is the working tool that turns frameworks into action. Each entry names the risk, the affected asset, the likelihood and impact ratings, the score, the planned treatment, the owner, the due date and the residual risk after treatment.

The register made the conversation with Anneliese short and productive. She could see the three highest risks at a glance, what each fix would cost and who was responsible. She approved the backups and segmentation immediately, asked Brightline to price multi-factor authentication for the bookkeeper's account, and signed acceptance of the two lowest risks. The register would be reviewed every six months and after any incident.

Two kinds of risk are easy to leave out of a first register. The first is third-party risk: the bakery depends on its point-of-sale vendor, its payment processor, its online ordering platform and Brightline itself, and a failure or breach at any of them becomes the bakery's problem. Keisha added a line for each critical supplier, with a note on what their contract said about security and how quickly they had to report incidents. The second is the risk of doing nothing about known weaknesses, such as the end-of-support PCs from Lesson 2. Writing those down, with an owner and a decision, is what turns a vague worry into a managed risk.