Chapter 2 of 4 · ISACA CRISC
Risk Assessment
Risk events, threats, vulnerabilities, risk scenarios, assessment standards, BIA, analysis methods and the risk register.
- 6topics
- 27 minfast track
- 2diagrams and exhibits
- 22%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Risk Events, Threat Modeling and the Threat LandscapeCRISC risk events and threats: threat sources and actors, the threat landscape, threat intelligence, and threat modeling with…4 min
- 2Vulnerability ManagementCRISC vulnerability management: finding weaknesses in people, process and technology, scanning and testing, CVSS, risk-based…4 min
- 3Risk Scenario Development and EvaluationCRISC risk scenarios: ISACA scenario components, top-down and bottom-up approaches, generic versus tailored scenarios, and…Diagram5 min
- 4Risk Assessment Concepts, Standards, Inherent and Residual RiskCRISC risk assessment concepts: likelihood and impact, ISO 31000, ISO/IEC 27005 and NIST SP 800-30 processes, and inherent versus…Diagram5 min
- 5Business Impact Analysis (BIA)CRISC business impact analysis: finding critical processes, measuring impact over time, setting MTD, RTO and RPO, dependencies…4 min
- 6Risk Analysis Methodologies and the Risk RegisterCRISC risk analysis: qualitative, semi-quantitative and quantitative methods, ALE and FAIR, other techniques, and what a good…5 min
About this chapter
What this chapter covers
Risk Assessment is 22% of the ISACA CRISC exam. It tests whether you can identify threats and vulnerabilities to people, processes and technology, build realistic risk scenarios, and analyse their likelihood and impact to produce a risk rating that management can act on.
The domain has two parts. Risk identification (2A) covers risk events, threat modeling and the threat landscape, vulnerability management, and risk scenario development and evaluation. Risk analysis (2B) covers risk assessment concepts and standards, business impact analysis, the risk register, risk analysis methodologies, and inherent and residual risk.
Questions are scenario based and ask what the practitioner should do FIRST, which input is MOST useful, or what BEST explains a rating. Expect to choose between qualitative and quantitative methods, and to decide whether a risk is inherent or residual.
How the topics fit together
Identification produces scenarios that describe how a risk could happen. Analysis then rates each scenario against agreed criteria, records it in the register with an owner, and compares it with appetite.
In this domain, the BEST answer usually depends on the business context. A severe vulnerability on a system with no sensitive data may rank below a moderate one on a critical payment system.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.