Security and Risk Management · Topic 6 of 7
Risk Management Concepts
Risk identification, qualitative and quantitative analysis, SLE, ALE and ARO, risk responses, control types, monitoring and frameworks such as NIST RMF.
- 4 min
- Includes a diagram
- SLE = AV × EF; ALE = SLE × ARO.
- Responses: mitigate, transfer, avoid, accept; never ignore.
- Transfer moves cost, not accountability.
What it is
Risk management finds what could harm the organization, measures how likely and how damaging it is, and decides what to do about it within the organization's risk appetite. Every control should trace back to a risk it reduces.
How it works
Key terms
| Term | Meaning |
|---|---|
| Asset | Anything of value |
| Threat | A potential cause of harm |
| Vulnerability | A weakness a threat could exploit |
| Risk | Likelihood that a threat exploits a vulnerability, and the impact |
| Exposure | Being open to loss from a threat |
| Risk appetite / tolerance | How much risk leadership is willing to accept |
| Residual risk | Risk left after controls; total risk minus control effect |
Qualitative and quantitative analysis
| Approach | How | Strength |
|---|---|---|
| Qualitative | Ratings such as high, medium, low; scenarios, workshops | Fast, covers hard-to-price impacts |
| Quantitative | Money values and frequencies | Supports cost-benefit decisions |
Quantitative formulas:
| Formula | Meaning |
|---|---|
| SLE = AV × EF | Single loss expectancy = asset value × exposure factor (fraction lost) |
| ALE = SLE × ARO | Annualized loss expectancy = SLE × annualized rate of occurrence |
| Safeguard value = ALE before − ALE after − annual cost of safeguard | Positive means the control is worth it |
Example: an asset worth $200,000 with a 25% exposure factor gives an SLE of $50,000. If the event is expected once every four years (ARO 0.25), the ALE is $12,500. A control costing $20,000 a year to remove that risk costs more than the loss it prevents.
A control should not cost more than the asset or the loss it prevents, unless law or contract requires it.
Risk responses
| Response | Meaning | Example |
|---|---|---|
| Mitigate (reduce) | Apply controls | Patch, segment, add MFA |
| Transfer (share) | Shift financial impact | Insurance, contracts |
| Avoid | Stop the risky activity | Retire a system |
| Accept | Formally acknowledge and live with it | Documented sign-off by the risk owner |
Ignoring a risk without a decision (sometimes called rejecting it) is never acceptable. Transfer moves financial impact, not accountability.
Control types and categories
| Function | Purpose | Example |
|---|---|---|
| Directive | Tell people what to do | Policy, signs |
| Deterrent | Discourage | Warning banners, guards |
| Preventive | Stop incidents | Firewalls, locks, MFA |
| Detective | Find incidents | IDS, audit logs, CCTV review |
| Corrective | Fix after an incident | Patching, restoring files |
| Recovery | Restore operations | Backups, alternate sites |
| Compensating | Alternative when the primary control is not possible | Isolation for systems that cannot be patched |
Categories: administrative (policies, training), technical / logical (encryption, access control) and physical (fences, locks).
Control assessment, monitoring and reporting
Assess whether controls are designed and working (security and privacy assessments), monitor risk continuously (key risk indicators), report to management in business terms, and improve. Maturity models show how established risk practices are.
Frameworks
NIST Risk Management Framework (SP 800-37): Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor. ISO/IEC 27005 and ISO 31000 give risk management guidance. Other frameworks such as FAIR support quantitative analysis.
How the exam asks about this
- "ALE is $20,000; the safeguard costs $60,000 a year; the loss is within appetite." Accept the risk with the owner's sign-off.
- "Legacy systems cannot meet a requirement." A compensating control approved by the risk owner.
- "Who accepts residual risk?" Senior management or the designated risk owner.
What to remember for the exam
- SLE = AV × EF; ALE = SLE × ARO.
- Responses: mitigate, transfer, avoid, accept; never ignore.
- Transfer moves cost, not accountability.
- Know control functions and the three categories.
- NIST RMF steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.
Risk acceptance must be a documented decision by someone with authority, not a default because nobody acted.
Common mistakes
Spending more on a control than the loss it prevents.
Treating insurance as eliminating the risk.
Confusing detective with preventive controls.
Check yourself
An asset is worth $100,000, the exposure factor is 40% and the event happens once every two years. What is the ALE?
SLE is $40,000, ARO is 0.5, so ALE is $20,000.
What kind of control is a backup?
A recovery control.
Who should formally accept a residual risk?
The risk owner or senior management with authority to do so.
Topic 6 of 7 in Security and Risk Management
Test yourself on Security and Risk Management
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.