Security Principles · Topic 2 of 4
Risk Management Concepts
The risk management lifecycle and processes for the ISC2 CC exam: assets, threats, vulnerabilities, likelihood and impact, risk treatments and who accepts risk.
- 3 min
- Includes a diagram
- Threat plus vulnerability plus impact makes risk.
- Lifecycle: identify, assess, treat, monitor.
- Four treatments: mitigate, transfer, avoid, accept.
What it is
Risk management is how an organization decides which dangers matter and what to do about them. No organization can remove every risk, so it identifies risks, ranks them, treats the most important ones and keeps watching.
How it works
Key terms
| Term | Meaning | Example |
|---|---|---|
| Asset | Something of value | Customer database |
| Threat | Anything that could cause harm | Ransomware gang, flood, careless employee |
| Vulnerability | A weakness a threat could exploit | Unpatched software |
| Likelihood | How probable the event is | Rare, likely, almost certain |
| Impact | How bad the result would be | Minor, major, severe |
| Risk | Likelihood that a threat exploits a vulnerability, combined with the impact |
The risk management lifecycle
- Identify risks: list assets, threats and vulnerabilities.
- Assess and prioritize: rate likelihood and impact, often on a risk matrix that plots one against the other.
- Treat: choose a response for each important risk.
- Monitor and review: check that treatments work and watch for new or changed risks.
Assessment can be qualitative (high, medium, low ratings) or quantitative (money values). Entry-level questions focus on the qualitative idea.
Risk treatments
| Treatment | Meaning | Example |
|---|---|---|
| Mitigate (reduce) | Add controls to lower likelihood or impact | Patch, train staff, add MFA |
| Transfer (share) | Shift the financial impact to another party | Buy insurance |
| Avoid | Stop the risky activity | Decide not to deploy an AI tool |
| Accept | Knowingly live with the risk | Owner signs off on a low risk |
Ignoring a risk without a decision is not a treatment.
The owner of the business process or asset accepts remaining (residual) risk. Analysts assess risk and vendors supply tools, but neither has the authority to accept it.
Risk appetite and tolerance
Risk appetite is how much risk leadership is willing to take to reach its goals. Risks above appetite need treatment; risks within it may be accepted.
Risk in AI projects
AI tools bring risks such as data leaking into public services, wrong or invented answers, biased decisions and dependence on one provider. They go through the same lifecycle: identify, assess, treat and monitor.
How the exam asks about this
- "A company buys cyber insurance for a data breach." Risk transfer.
- "A company decides not to launch a risky product." Risk avoidance.
- "Which tool plots likelihood against impact?" A risk matrix.
What to remember for the exam
- Threat plus vulnerability plus impact makes risk.
- Lifecycle: identify, assess, treat, monitor.
- Four treatments: mitigate, transfer, avoid, accept.
- The risk owner accepts residual risk.
- Transfer moves cost, not responsibility.
Buying insurance does not remove the risk of a breach. It only helps with the financial loss afterwards.
Common mistakes
Mixing up threat and vulnerability. A threat causes harm; a vulnerability is the weakness it uses.
Thinking risk can be reduced to zero.
Letting the person who assessed the risk accept it.
Check yourself
Which treatment is buying insurance?
Risk transfer.
What is a vulnerability?
A weakness that a threat could exploit.
Who should formally accept remaining risk?
The owner of the business process or asset.
Topic 2 of 4 in Security Principles
Test yourself on Security Principles
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.