Security Program Management and Oversight · Topic 2 of 7
Risk Assessment and Analysis
Security+ risk identification, scoring and categorization, impact and likelihood, qualitative vs quantitative analysis, risk owners and the risk register.
- 4 min
- Identification begins with an asset inventory and named owners.
- Scoring commonly multiplies likelihood by impact.
- Categorization groups risks by level or by type.
What it is
Risk is the chance that a threat will exploit a weakness and cause a loss. Risk management is the process of finding risks, measuring them, deciding what to do and tracking the result.
This page covers the first half of that process: identification, assessment, analysis and the risk register. The next page covers treatment and the business-level decisions, including the loss formulas.
How it works
Risk identification
Identification starts with asset identification: you cannot protect what you do not know you have. The asset list covers hardware, software, data, services, people and facilities, with the value of each to the business.
Stakeholder ownership means every asset and every risk has a named person who is accountable for it. Without an owner, nobody decides what to do and the risk stays open.
Sources for finding risks include the asset inventory, threat intelligence, vulnerability scans, audit findings and past incidents.
Risk assessment
| Element | Meaning |
|---|---|
| Scoring | Giving each risk a value, often likelihood multiplied by impact on a scale such as 1 to 5 |
| Categorization | Grouping risks, by level such as low, medium, high and critical, or by type such as operational, financial, legal or reputational |
A score lets risks be ranked and compared, and is often shown as a heat map. Categories help route each risk to the right team and show patterns across the organization.
Risk analysis
| Element | Meaning |
|---|---|
| Impact | The damage if the event happens, in money, downtime, data loss or reputation |
| Likelihood or probability | How likely the event is. Probability is a numeric chance, while likelihood is often a rating on a scale |
| Owner | The person accountable for the risk and for choosing the response |
| Current mitigations | Controls already in place that reduce likelihood or impact |
| Qualitative vs. quantitative | Rating with judgment and scales, or calculating with numbers |
Current mitigations matter because they change the real level of risk. A server with an unpatched flaw is a lower risk if it sits behind a firewall with no outside access.
Qualitative and quantitative analysis
| Approach | Method | Result |
|---|---|---|
| Qualitative | Uses judgment and scales such as low, medium and high | A ranking of risks |
| Quantitative | Uses numbers, usually money values | A cost estimate for each risk, such as an annual loss |
Qualitative analysis is faster and easier but less exact. Quantitative analysis supports cost benefit decisions, but it needs reliable data, and many organizations combine the two.
Risk register
A risk register is the central record of identified risks. Each entry usually holds a description, the owner, likelihood and impact ratings, the score, current mitigations, the chosen response and the status.
| Register activity | Meaning |
|---|---|
| Communication | Sharing the register with owners, management and other stakeholders so they know the risks and their duties |
| Reviews | Checking entries on a schedule and after major changes, updating scores and closing risks that no longer apply |
A register that is never reviewed becomes out of date. New systems, threats and controls change the picture, so the register must change with them.
How the exam asks about this
- "No one can say who should decide how to handle a risk to the payroll database." -> Stakeholder ownership is missing, so assign a risk owner.
- "Risks are rated low, medium or high by a panel of managers." -> Qualitative analysis.
- "The team lists every server, application and data store before rating risks." -> Asset identification.
What to remember for the exam
- Identification begins with an asset inventory and named owners.
- Scoring commonly multiplies likelihood by impact.
- Categorization groups risks by level or by type.
- Impact is the damage. Likelihood is how probable the event is.
- Current mitigations lower the real risk and must be counted.
- Qualitative analysis ranks risks with scales. Quantitative analysis assigns money values.
- A risk register lists risks with owners, ratings, responses and status.
- The register must be communicated and reviewed regularly.
If a question describes ratings such as high, medium and low, the answer is qualitative. If it uses currency amounts and rates per year, it is quantitative.
Common mistakes
Skipping asset identification. Risks to unknown assets are never assessed.
Leaving risks without an owner. A risk with no owner rarely gets treated.
Ignoring current mitigations. Rating a risk as if no controls exist overstates it and wastes money.
Treating a qualitative rating as exact. A rating of "high" is a judgment, not a measurement.
Filling the register once. It is a living document that needs regular review.
Quantitative figures are only as good as the inputs. Weak estimates of value or frequency give weak results.
Check yourself
What is usually multiplied to produce a risk score?
Likelihood and impact.
Why must current mitigations be considered in risk analysis?
Existing controls reduce likelihood or impact, so ignoring them overstates the real risk.
What two activities keep a risk register useful?
Communication of the risks to owners and stakeholders, and regular reviews to update entries.
Topic 2 of 7 in Security Program Management and Oversight
Test yourself on Security Program Management and Oversight
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.