Risk Management

Exam objective 5.2: Explain the impact of risk management processes on the security of the organization.

This objective covers the full risk management life cycle as CompTIA frames it: identifying assets and the stakeholders who own them, assessing and scoring risks, analyzing impact and likelihood with qualitative and quantitative methods, recording and communicating risk in a risk register, choosing a treatment (transfer, accept, avoid, or mitigate), and connecting all of it to business-level concepts such as the business impact analysis (BIA), risk appetite, residual risk, management oversight, and regulatory and legal drivers. It also includes the three quantitative formulas every Security+ candidate must know cold: single loss expectancy (SLE), annualized rate of occurrence (ARO), and annualized loss expectancy (ALE).

This is an "explain" objective, so expect questions that describe a situation and ask which step of the process is happening, which treatment was chosen, or what a calculated value means. You should also be ready for at least one arithmetic question. The math is simple multiplication, but the exam will try to trip you up with percentages, fractional AROs, and distractors that use the wrong formula. Work every example in this chapter by hand until the formulas are automatic.

What Risk Management Is For

Risk is the possibility that a threat will exploit a vulnerability and cause harm to an asset. A common shorthand is risk = likelihood x impact: a risk is large when something bad is both reasonably likely to happen and costly when it does. Neither factor alone is enough. A meteor strike on the head office would be catastrophic but is vanishingly unlikely; a user mistyping a password is almost certain but harmless.

Risk management is the ongoing, organization-wide process of identifying, assessing, analyzing, treating, and monitoring risks so that the organization can pursue its goals with an acceptable level of uncertainty. The key word is acceptable. No organization eliminates risk. The goal is to spend money and effort where they reduce the most risk, accept what is tolerable, and make those choices deliberately rather than by accident. A working process means security budgets are justified by business impact, executives knowingly own the risks they accept, and auditors can see a defensible decision trail. Phase Core question Main outputs

Identificati

on

What do we have, and what could go wrong with it?

Asset inventory, list of threats and vulnerabilities, named owners

Assessmen

t

How serious is each risk compared with the others?

Scores, categories, prioritized list

Phase Core question Main outputs

Analysis What is the impact and likelihood, and what controls already exist?

Qualitative ratings or quantitative values (SLE, ARO, ALE)

Risk register

Where is all this recorded and shared? Register entries, owner assignments, review schedule

Treatment What will we do about each risk? Decision to transfer, accept, avoid, or mitigate; action plans

Monitoring

and review

Is the risk changing, and are treatments working?

Updated register, reports to management

Risk Identification

You cannot manage a risk you have not identified. Identification answers two questions: what are we protecting, and who is responsible for it?

Asset Identification

Asset identification is the process of building and maintaining an inventory of everything of value to the organization. Assets include hardware (servers, laptops, network devices, OT controllers), software and licenses, data (customer records, intellectual property, financial data), services (cloud subscriptions, SaaS applications), people and their knowledge, facilities, and intangibles such as reputation and brand. Each asset needs enough information to support risk decisions:

• Value — replacement cost, revenue it supports, or the cost of losing its confidentiality, integrity, or availability. This becomes the asset value (AV) used in quantitative analysis.
• Classification — how sensitive the asset or data is (see the data classification discussion in Chapter 12).
• Criticality — how essential the asset is to business functions, which ties directly to the BIA.
• Location and dependencies — where it lives and what other systems depend on it or it depends on.
• Owner — the accountable person, discussed next.

Asset identification builds on asset management (Chapter 15); an asset missing from the inventory has invisible risks, which is why shadow IT is so dangerous. Once assets are known, identification continues by asking what threats (actors and events, Chapters 4 and 5) could act on each asset and what vulnerabilities (weaknesses, Chapter 7) they could exploit. Sources include vulnerability scans, threat intelligence, past incidents, audit findings, interviews with business units, and brainstorming workshops.

Stakeholder Ownership

Stakeholder ownership means that every significant asset and every identified risk is assigned to a named person who is accountable for it. The owner is normally a business leader, not the security team. The head of payroll owns the payroll system's business risk; the security team advises, measures, and helps implement controls.

Ownership matters because risk decisions are business decisions. Accepting a risk, funding a mitigation, or retiring a system all involve trade-offs between cost, revenue, and operations that only the business can make. When risks have no owner, nobody approves treatment, nobody pays for it, and nobody is accountable when it materializes.

Exam tip

If a question asks who should decide whether to accept a risk to a business system, the answer is the business owner of that system (or senior management), not the security analyst or the IT administrator. Security recommends; owners decide.

Risk Assessment

Assessment takes the list of identified risks and determines how they compare with one another. CompTIA lists two elements: scoring and categorization.

Scoring

Risk scoring assigns each risk a value that allows ranking. The most common approach multiplies a likelihood rating by an impact rating, each on a scale such as 1 to 5. A risk with likelihood 4 and impact 5 scores 20; one with likelihood 2 and impact 3 scores 6. The higher score gets attention first. Scores are often displayed on a risk matrix or heat map, a grid with likelihood on one axis and impact on the other, color-coded from green (low) through yellow and orange to red (critical).

• Likelihood / Impact Low (1) Moderate (3) High (5)
• High (5) 5 — Medium 15 — High 25 — Critical
• Moderate (3) 3 — Low 9 — Medium 15 — High
• Low (1) 1 — Low 3 — Low 5 — Medium
• Categorization

Risk categorization groups risks by type so that patterns emerge and the right people are involved. Common categories are strategic (business goals, mergers), operational (failures of processes, people, or systems, which includes most cyber risk), financial (fraud, lost revenue), compliance and legal, reputational, technology and cyber, and third-party (vendors and suppliers, Chapter 24). Risks can also be categorized by severity tier or by the CIA property affected.

Categorization reveals patterns: if seven of the ten highest risks involve third parties, a vendor risk program may be a better investment than seven separate fixes.

Risk Analysis

Analysis digs deeper into each risk: its impact, its likelihood, its owner, the mitigations already in place, and whether to measure it qualitatively or quantitatively.

Impact

Impact is the magnitude of harm if the risk materializes. It may be expressed in dollars, in downtime, in number of records exposed, or on a descriptive scale. Good impact analysis looks beyond immediate technical damage to direct financial loss, operational disruption, legal and regulatory penalties, reputational harm, and, in healthcare, utilities, and manufacturing, risk to human safety, which outranks everything else.

Likelihood and Probability

Likelihood is how probable it is that the risk will occur in a given time frame. In qualitative analysis it is expressed as a rating (rare, unlikely, possible, likely, almost certain). In quantitative analysis it is expressed as a probability or frequency, most commonly the ARO discussed below. Likelihood depends on threat activity (is this being exploited in the wild?), exposure (is the asset internet-facing?), and the strength of existing controls.

Owner

The analysis records the risk owner, the person accountable for managing the risk and deciding on its treatment. This is the same idea as stakeholder ownership during identification, now attached to a specific risk rather than to an asset. One asset can have several risks, and they may have different owners: the data center manager might own the flood risk to a server room, while the application owner owns the risk of an unpatched web framework running on those servers.

Current Mitigations

Current mitigations (existing controls) are the safeguards already in place that reduce likelihood or impact. Analysis must account for them, or it will overstate risk and misdirect spending. This leads to two important terms:

• Inherent risk — the level of risk before any controls are considered.
• Residual risk — the level of risk that remains after controls are applied.

Analysts typically record the inherent rating, list the existing controls, and then record the current residual rating. If residual risk is still above what the organization will tolerate, further treatment is needed. Some frameworks also describe control risk, the risk that an existing control fails or is less effective than assumed, which is why controls must be tested rather than simply listed.

Note

A shortcut many instructors use is inherent risk minus the effect of controls equals residual risk. It is a conceptual relationship, not a literal subtraction, but it captures the idea: controls reduce risk; they never reduce it to zero.

Qualitative vs. Quantitative Analysis

Qualitative risk analysis uses descriptive ratings (low, medium, high; or numeric scales like 1 to 5 that represent categories rather than measured quantities). It relies on expert judgment, workshops, and interviews. It is fast, inexpensive, works when data is scarce, and is easy for executives to read on a heat map. Its weaknesses are subjectivity and difficulty comparing a "high" risk against the dollar cost of a control.

Quantitative risk analysis assigns objective, usually monetary, values to assets, losses, and frequencies. It produces numbers such as "this risk costs us an expected $120,000 per year," which can be compared directly to the cost of a control. Its weaknesses are that good data is hard to obtain, the precision can be misleading, and it takes more time and effort.

Factor Qualitative Quantitative

Expression Ratings: low/medium/high, 1-5 scales, colors Monetary values and frequencies (SLE, ARO, ALE) Basis Expert judgment, experience, consensus Historical data, actuarial tables, asset values Speed and cost

Fast, inexpensive Slower, more data-intensive

Strength Easy to communicate; works with limited data Supports cost-benefit analysis of controls Weakness Subjective; hard to compare to dollar costs Data may be unavailable; false precision Typical output

Heat map, ranked list Dollar figures for expected annual loss

Most organizations combine them (semi-quantitative analysis): triage everything qualitatively, then quantify the few big risks where a major spending decision is at stake.

Qualitative = Quality words (high, medium, low). Quantitative = Quantity in dollars. If the question includes dollar amounts and asks you to calculate expected loss, it is quantitative.

Quantitative Formulas: SLE, ARO, and ALE

These terms appear in the business-level portion of the objective, but they are the heart of quantitative analysis, so we cover them here with worked examples. Two supporting terms come first.

• Asset value (AV) — the monetary value of the asset, including replacement cost and, where appropriate, the value of lost revenue or data.
• Exposure factor (EF) — the percentage of the asset's value that would be lost in a single occurrence of the event. A fire that destroys half of a warehouse has an EF of 50 percent; a stolen laptop that is never recovered has an EF of 100 percent.

The three exam formulas are:

• Single loss expectancy (SLE) — the expected monetary loss each time the event occurs. SLE = AV x EF.
• Annualized rate of occurrence (ARO) — how many times the event is expected to occur in one year. An event expected twice a year has an ARO of 2. An event expected once every ten years has an ARO of 0.1 (1 divided by 10).
• Annualized loss expectancy (ALE) — the expected monetary loss per year from the risk. ALE = SLE x ARO.

• AV = asset value ($)
• EF = exposure factor (% of AV lost per incident)
• SLE = AV x EF -> cost of one incident
• ARO = incidents per year -> once every N years = 1/N
• ALE = SLE x ARO -> expected cost per year

Value of a control = (ALE before) - (ALE after) - (annual cost of control)

Worked Example 1: Laptop Theft

A consulting firm issues laptops to 400 employees. Each laptop costs $1,800 to replace, and IT estimates another $200 of labor to provision a replacement, so the asset value per incident is $2,000. Stolen laptops are never recovered, so the exposure factor is 100 percent. Over the past three years the firm has lost an average of 12 laptops per year.

• SLE = AV x EF = $2,000 x 1.00 = $2,000

• aro = 12

• ALE = SLE x ARO = $2,000 x 12 = $24,000 per year

The firm considers a control: a combination of cable locks, a "never leave the laptop in a car" awareness campaign, and device tracking software. The vendor quotes $9,000 per year, and the firm estimates thefts will drop to 4 per year.

• New ALE = $2,000 x 4 = $8,000 per year
• Reduction in ALE = $24,000 - $8,000 = $16,000
• Value of the control = $16,000 - $9,000 = $7,000 per year net benefit Because the control saves more than it costs, it is financially justified. Note that this covers only hardware; exposure of customer data on the laptops is a separate risk whose EF full-disk encryption (Chapter 12) dramatically reduces.

Figure 23.1: SLE, ARO, and ALE calculated for the laptop theft example and used to judge whether the control is worth its cost Worked Example 2: Flood Damage to a Data Center

A regional data center and its equipment are valued at $3,000,000. Engineers estimate that a major flood would damage 40 percent of that value. Flood maps indicate such a flood is expected about once every 50 years.

• SLE = $3,000,000 x 0.40 = $1,200,000
• ARO = 1 / 50 = 0.02
• ALE = $1,200,000 x 0.02 = $24,000 per year

An insurer offers flood coverage for $30,000 per year. On expected value alone, the premium ($30,000) exceeds the ALE ($24,000), so a purely mathematical analysis might say "accept." But a single $1.2 million loss could threaten the business's survival, and the organization's risk appetite for catastrophic, low-frequency events may be very low. Many organizations buy the insurance anyway, because transferring a survivable annual cost in exchange for removing a catastrophic one-time loss is a sound business choice. This is a good illustration that ALE is an input to decisions, not the decision itself.

Worked Example 3: Ransomware Outage on an E-Commerce Site

An online retailer's order system generates $50,000 of revenue per hour. Analysts estimate that a successful ransomware attack would cause 36 hours of outage before restoration from backups, plus $150,000 in incident response, forensics, and recovery labor. Threat intelligence and peer data suggest a successful attack is likely about once every four years given current controls.

• SLE = (36 hours x $50,000) + $150,000 = $1,800,000 + $150,000 = $1,950,000
• ARO = 1 / 4 = 0.25
• ALE = $1,950,000 x 0.25 = $487,500 per year

Here the SLE was built directly from impact components rather than from AV x EF. That is common in practice and perfectly valid: SLE is simply the expected cost of one occurrence.

Common trap

Watch for these traps on calculation questions. (1) An exposure factor given as a percentage must be converted: 25 percent is 0.25. (2) "Once every five years" is an ARO of 0.2, not 5. (3) If the question asks for SLE, do not multiply by ARO. (4) If a control costs more per year than the ALE reduction it provides, it is not cost-justified on financial grounds.

Real-world scenario

A hospital's risk committee is reviewing a proposal to install a $40,000-per-year water detection and automatic shutoff system above its imaging center. The imaging equipment is valued at $2,500,000, a burst pipe would damage roughly 20 percent of it, and facilities records show one serious leak about every five years. SLE = $2,500,000 x 0.20 = $500,000. ARO = 0.2. ALE = $100,000. If the system is expected to cut the exposure factor to 2 percent, the new SLE is $50,000 and the new ALE is $10,000. The ALE reduction is $90,000, which exceeds the $40,000 cost by $50,000. The committee approves the mitigation and records the residual ALE of $10,000 in the risk register.

The Risk Register

A risk register (sometimes called a risk log) is the central document or system that records identified risks and everything known about them. It can be a spreadsheet, a module in a governance, risk, and compliance (GRC) platform, or part of an enterprise risk management (ERM) tool. Typical fields include:

• Risk ID and short description
• Category
• Affected assets
• Risk owner
• Inherent likelihood, impact, and score
• Existing controls (current mitigations)
• Residual likelihood, impact, and score
• Treatment decision and planned actions, with due dates
• Key risk indicators (KRIs) — metrics that signal the risk is increasing, such as the number of unpatched critical vulnerabilities or failed backup jobs
• Status and date of last review

• Risk ID: R-2026-014
• Description: Ransomware encrypts order-processing servers
• Category: Operational / Cyber
• Owner: VP, E-Commerce Operations
• Inherent: Likelihood 4, Impact 5 = 20 (Critical)
• Controls: EDR on servers; nightly backups; email filtering
• Residual: Likelihood 3, Impact 4 = 12 (High)
• Treatment: Mitigate - immutable backups, MFA for admin access (due Q1)
• KRI: Backup job failure rate > 2%; admin accounts without MFA > 0
• Last review: 2026-09-15 Next review: 2026-12-15
• Communication

The risk register is a communication tool as much as a record. It gives executives, the board, auditors, and business units a common, current view of the organization's risk posture. Good communication means summarizing the register for each audience: a board may see only the top ten risks on a heat map and trend arrows; a business unit sees every risk it owns, with action items and deadlines; auditors see the full history of decisions and approvals.

Reviews

Risks are not static. New threats emerge, assets change, controls degrade, and business priorities shift. The register must be reviewed on a regular schedule (for example, quarterly for high risks and annually for low ones) and whenever a significant event occurs: a major incident, an acquisition, a new regulation, a large system change, or a new vendor relationship. Reviews confirm that owners, scores, and treatments are still accurate. Accepted risks in particular should carry an expiration date so they are reconsidered rather than forgotten.

Exam tip

If a question describes a document that lists risks along with their owners, scores, and treatment status, the answer is a risk register. If it describes a color-coded grid of likelihood versus impact, the answer is a risk matrix or heat map.

Risk Treatment

Risk treatment (also called risk response) is the decision about what to do with each risk. CompTIA lists four strategies.

Transferring

Risk transference shifts some or all of the financial impact of a risk to another party. The classic example is cybersecurity insurance, which pays for breach response, legal costs, business interruption, and sometimes ransom. Contracts transfer risk too: outsourcing a function to a managed service provider with indemnification clauses, or requiring a vendor to carry insurance and accept liability for its failures (see Chapter 24).

Transference has limits. Insurance pays money; it does not restore customer trust, and legal accountability for protecting personal data generally stays with the organization that collected it. Insurers also increasingly require baseline controls such as MFA, EDR, and offline backups before writing a policy. Some sources call this strategy risk sharing because deductibles, exclusions, and reputational impact keep part of the risk with the organization.

Accepting

Risk acceptance means acknowledging the risk and choosing not to take further action, usually because the cost of treatment exceeds the expected loss or because the risk is already within appetite. Acceptance must be a deliberate, documented decision by someone with authority, typically the risk owner or senior management, not a default caused by inaction. A formal, approved deviation from a policy requirement is called an exception (usually time-limited and paired with compensating controls); a decision that a requirement does not apply at all is an exemption. For example, a legacy lab instrument that cannot run EDR might receive a one-year exception with network isolation as a compensating control.

Avoiding

Risk avoidance eliminates the risk by stopping or never starting the activity that creates it. A company that decides not to store credit card numbers at all, and instead uses a payment processor's hosted page, avoids most of the risk of storing cardholder data. A business that declines to open an office in a country with a hostile legal environment avoids those jurisdictional risks. Avoidance is effective but often means giving up a business opportunity, so it is chosen when the risk clearly outweighs the benefit.

Mitigating

Risk mitigation (also called risk reduction) applies controls that reduce the likelihood, the impact, or both, until the residual risk is acceptable. Most security work falls here: patching, MFA, segmentation, backups, training, monitoring, and so on. Mitigation is justified when the reduction in expected loss is worth the cost, as the worked examples showed.

Strategy What it does Example Common exam keywords

Transfer Shifts financial impact to a third party

Cyber insurance; outsourcing with indemnification

Insurance, contract, liability, third party

Accept Acknowledges and tolerates the

risk

Signed exception for a legacy system

Cost exceeds benefit, low impact, exception, exemption

Avoid Eliminates the activity causing the risk

Stop storing card data; cancel risky project

Discontinue, do not deploy, remove

Mitigate Reduces likelihood or impact with controls

Deploy MFA, patch, add backups

Implement control, reduce, harden

Memory aid

The four treatments are sometimes remembered as "TAAM" — Transfer, Accept, Avoid, Mitigate. Ask yourself: did they pay someone (transfer), sign off on it (accept), stop doing it (avoid), or fix it (mitigate)?

Common trap

Ignoring a risk, sometimes called risk rejection or denial, is not a legitimate treatment. If a question describes management being informed of a risk and doing nothing without any documented decision, that is negligence, not acceptance.

Business-Level Risk Concepts

The final part of the objective ties risk management to the business as a whole.

Business Impact Analysis (BIA)

A business impact analysis identifies the organization's critical business functions, the resources they depend on, and the consequences of disrupting them over time. Where a risk assessment asks "what could go wrong and how likely is it?", a BIA asks "if this function stopped, how bad would it be, and how quickly must it come back?" The BIA is the foundation of business continuity and disaster recovery planning (Chapter 13) and supplies impact data to the risk process.

Key BIA metrics include:

• Maximum tolerable downtime (MTD) — the longest a function can be unavailable before the organization suffers unacceptable harm. Also called maximum allowable outage.
• Recovery time objective (RTO) — the target time to restore a function after disruption. RTO must be shorter than MTD.
• Recovery point objective (RPO) — the maximum acceptable amount of data loss, measured in time. An RPO of four hours means backups or replication must ensure no more than four hours of data are lost.
• Mean time to repair (MTTR) — the average time to fix a failed component and return it to service.
• Mean time between failures (MTBF) — the average time a repairable component operates between failures; a measure of reliability.

Figure 23.2: How RPO, RTO, and MTD sit on a timeline around a disruption

The BIA also identifies mission-essential functions, critical systems, single points of failure, and the dependencies between them. Its outputs feed directly into impact ratings and SLE estimates during risk analysis.

Exam tip

RPO is about data (how much can we lose?); RTO is about time (how fast must we be back?). If a question mentions "how far back" or "the last good backup," think RPO. If it mentions "how long until restored," think RTO.

Risk Appetite

Risk appetite is the amount and type of risk an organization is willing to pursue or retain in order to achieve its objectives. It is set by senior leadership and the board and expressed in a risk appetite statement. Appetite is often described in three broad postures:

• Expansionary — willing to take on more risk in pursuit of growth and innovation, typical of startups and organizations entering new markets.
• Conservative — prefers lower risk, accepting slower growth in exchange for stability; typical of regulated industries such as banking and healthcare.
• Neutral — a balanced position between the two.

Two related terms help make appetite actionable. Risk tolerance is the acceptable deviation from the appetite for a specific risk or objective (for example, "no more than four hours of downtime per quarter for the customer portal"). A risk threshold is the point at which a risk must be escalated or treated. When a residual risk exceeds the threshold, it can no longer simply be accepted at the operational level.

Residual Risk

Residual risk is the risk that remains after treatment. It is compared to risk appetite: if residual risk falls within appetite, the organization accepts it; if not, further treatment is needed. Every treatment leaves some residual risk, because no control is perfect. Insurance leaves deductibles and reputational impact; mitigation leaves the chance that controls fail; even avoidance may leave residual risk if the activity is not fully eliminated.

Figure 23.3: The ransomware register entry moving from inherent risk to current residual risk and then below the risk appetite after further treatment

Stakeholder Involvement

Stakeholder involvement means bringing in the people affected by and responsible for risks: business unit leaders, IT, legal, compliance, finance, human resources, operations, and sometimes customers, partners, and regulators. Involvement improves accuracy (the payroll manager knows what a payroll outage really costs), builds buy-in for controls, and ensures treatment decisions are made by those with authority. Excluding stakeholders leads to unrealistic impact estimates and controls that the business resists or works around.

Management Oversight

Management oversight is the responsibility of senior leadership and the board to direct, approve, and monitor the risk management program. Oversight includes setting risk appetite, approving the risk management policy, receiving regular risk reports, approving major acceptances and exceptions, and funding treatment. A risk committee or audit committee often performs this function.

Regulatory

Regulatory factors are requirements imposed by government agencies and industry regulators that shape risk decisions. Some risks cannot simply be accepted because a regulation requires a specific control. For example, HIPAA's Security Rule requires covered entities to conduct a risk analysis and implement safeguards for electronic protected health information, and the GDPR requires appropriate technical and organizational measures for personal data. Regulatory risk also includes the risk of fines, mandatory audits, and enforcement actions when controls fail. Chapter 25 covers compliance in depth.

Legal

Legal factors include laws, contracts, and litigation exposure. Contracts with customers may promise specific protections; breach notification laws in every US state, in Canada under PIPEDA, and in the EU under the GDPR require disclosure of certain incidents; and data breaches frequently lead to lawsuits. Legal counsel helps determine whether a risk creates liability and how treatment decisions should be documented in case a court later examines them.

Real-world scenario

A payments startup with an expansionary risk appetite wants to launch a new mobile wallet within six weeks. The risk assessment shows that the wallet's API has not undergone a penetration test. The CISO presents the residual risk to the executive team, noting that a regulatory requirement from the startup's banking partner mandates testing before launch. Even though the startup tolerates high business risk, it cannot accept this one: the regulatory and contractual obligation removes acceptance as an option. Management approves a compressed test schedule (mitigation) and delays launch by one week.

Chapter Summary

• Risk is the combination of likelihood and impact. Risk management identifies, assesses, analyzes, treats, and monitors risk so that residual risk stays within the organization's appetite.
• Identification builds an asset inventory and assigns stakeholder ownership; business owners, not security staff, are accountable for risk decisions.
• Assessment scores risks (often likelihood x impact on a heat map) and categorizes them so patterns and priorities are visible.
• Analysis examines impact, likelihood, owner, and current mitigations. Inherent risk is before controls; residual risk is after.
• Qualitative analysis uses descriptive ratings; quantitative analysis uses monetary values. Most organizations combine them.
• SLE = AV x EF; ALE = SLE x ARO; an event once every N years has ARO = 1/N. A control is cost-justified when the ALE reduction exceeds its annual cost.
• The risk register records risks, owners, scores, treatments, and KRIs; it supports communication and must be reviewed regularly.
• Treatments are transfer (insurance, contracts), accept (documented decision, exceptions, exemptions), avoid (stop the activity), and mitigate (apply controls).
• The BIA identifies critical functions and sets MTD, RTO, and RPO. Risk appetite (expansionary, conservative, neutral), tolerance, and thresholds guide decisions.
• Stakeholder involvement, management oversight, and regulatory and legal obligations shape which risks can be accepted and how decisions are documented.

Key Terms

Risk; risk management; asset identification; asset value (AV); stakeholder ownership; risk owner; risk scoring; risk matrix; heat map; risk categorization; impact; likelihood; probability; current mitigations; inherent risk; residual risk; control risk; qualitative risk analysis; quantitative risk analysis; semi-quantitative analysis; exposure factor (EF); single loss expectancy (SLE); annualized rate of occurrence (ARO); annualized loss expectancy (ALE); risk register; key risk indicator (KRI); risk transference; cybersecurity insurance; risk acceptance; exemption; exception; risk avoidance; risk mitigation; business impact analysis (BIA); maximum tolerable downtime (MTD); recovery time objective (RTO); recovery point objective (RPO); mean time to repair (MTTR); mean time between failures (MTBF); risk appetite; expansionary; conservative; neutral; risk tolerance; risk threshold; stakeholder involvement; management oversight.

Review Questions

• 1. A company's file server is valued at $80,000. A fire in the server room would destroy 75 percent of its value. Fires of this kind are expected once every 20 years. What is the ALE?

• A. $3,000
• B. $4,000
• C. $60,000
• D. $1,200,000

• 2. A retail chain decides to stop accepting checks at its stores after repeated losses from check fraud. Which risk treatment has the chain chosen?

• A. Transfer
• B. Accept
• C. Avoid
• D. Mitigate

• 3. A security analyst discovers that a manufacturing plant's control system cannot be patched without vendor support that is no longer available. Who should make the final decision to accept the remaining risk?

• A. The security analyst who found the issue
• B. The plant's business owner or senior management
• C. The IT help desk manager
• D. The control system vendor

• 4. Which of the following BEST describes the difference between inherent and residual risk?

• A. Inherent risk is calculated quantitatively; residual risk is calculated qualitatively.
• B. Inherent risk exists before controls are applied; residual risk remains after controls are applied.
• C. Inherent risk applies to third parties; residual risk applies to internal systems.
• D. Inherent risk is accepted by management; residual risk is transferred to insurers.

• 5. An organization's risk committee wants a single document that lists each identified risk, its owner, its current score, existing controls, planned treatment, and the date of its next review. What should the committee use?

• A. Business impact analysis
• B. Risk register
• C. Service-level agreement
• D. Heat map

• 6. A company pays $45,000 per year for a cyber insurance policy that covers breach response costs and business interruption. Which risk treatment does this represent?

• A. Avoidance
• B. Acceptance
• C. Mitigation
• D. Transference

• 7. A risk analyst calculates that a web application outage has an SLE of $40,000 and an ARO of 3. A proposed load-balancing solution costs $50,000 per year and would reduce the ARO to 0.5. Which statement is correct?

• A. The control is not justified because its cost exceeds the SLE.
• B. The control is justified because it reduces the ALE by $100,000, which exceeds its cost.
• C. The control is justified because the new ALE is $50,000.
• D. The control is not justified because the new ALE is greater than zero.

• 8. During a risk workshop, participants rate each risk as low, medium, or high for likelihood and impact based on their experience, then plot the results on a color-coded grid. Which type of analysis is being performed? (Select TWO.)

• A. Qualitative analysis
• B. Quantitative analysis
• C. Business impact analysis
• D. Risk matrix (heat map) scoring
• E. Annualized loss expectancy calculation

• 9. A business impact analysis determines that the order-processing system can lose no more than 15 minutes of transactions in an outage. Which metric does this define?

• A. RTO
• B. MTD
• C. RPO
• D. MTBF

• 10. A biotechnology startup's board states that it is willing to accept significant operational and technology risk to bring products to market quickly. How would this risk appetite BEST be described?

• A. Conservative
• B. Neutral
• C. Expansionary
• D. Residual

• 11. A legacy point-of-sale system cannot support modern encryption. The CIO signs a document allowing it to remain in service for six months while it is isolated on its own network segment and monitored, after which it must be replaced. Which TWO terms describe this situation? (Select TWO.)

• A. Risk avoidance
• B. Exception
• C. Compensating control
• D. Risk transference
• E. Exposure factor

• 12. An organization's quarterly risk review finds that a ransomware risk rated "medium" last year now shows a sharp increase in failed backup jobs and in endpoints missing EDR agents. Which register element alerted the team to the change?

• A. Exposure factor
• B. Key risk indicators
• C. Risk appetite statement
• D. Single loss expectancy

Answers and Explanations

• 1. A. SLE = AV x EF = $80,000 x 0.75 = $60,000. ARO = 1/20 = 0.05. ALE = $60,000 x 0.05 = $3,000. Option B uses the full asset value instead of applying the exposure factor ($80,000 x 0.05). Option C is the SLE, not the ALE. Option D multiplies the SLE by 20 instead of dividing, confusing "once every 20 years" with "20 times per year."
• 2. C. Stopping the activity that creates the risk eliminates the risk entirely, which is avoidance. Transfer would involve insurance or a third party, such as a check guarantee service. Acceptance would continue taking checks and tolerating losses. Mitigation would add controls such as check verification while continuing to accept checks.
• 3. B. Risk acceptance is a business decision made by the risk owner or senior management, who have authority over the business function and its budget. The security analyst identifies and reports the risk but does not own it. The help desk manager has no authority over the plant. The vendor is not part of the organization and cannot accept risk on its behalf.
• 4. B. Inherent risk is the raw level of risk before any controls; residual risk is what remains after controls or other treatments are applied. Either can be expressed qualitatively or quantitatively, so option A is wrong. Options C and D invent distinctions that do not exist.
• 5. B. A risk register is the central record of risks, owners, scores, controls, treatments, and review dates. A BIA focuses on critical functions and recovery requirements. An SLA is a contract with a service provider. A heat map visualizes scores but does not track owners, treatments, and review dates.
• 6. D. Insurance shifts the financial impact of a risk to the insurer, which is transference. The company is not stopping the activity (avoidance), simply tolerating the risk (acceptance), or reducing likelihood or impact with a control (mitigation), although insurers often require mitigations as a condition of coverage.
• 7. B. The current ALE is $40,000 x 3 = $120,000. With the control, ALE = $40,000 x 0.5 = $20,000. The ALE reduction is $100,000, which exceeds the $50,000 annual cost, giving a $50,000 net benefit. Option A compares the cost to the SLE, which is the wrong comparison. Option C states an incorrect new ALE. Option D is wrong because no control reduces risk to zero; residual risk is expected.
• 8. A, D. Descriptive ratings based on expert judgment are qualitative analysis, and plotting likelihood against impact on a color-coded grid is risk matrix or heat map scoring. Quantitative analysis and ALE calculation require monetary values. A BIA examines critical business functions and recovery requirements rather than rating individual risks.
• 9. C. The recovery point objective defines the maximum acceptable data loss measured in time. RTO is the target time to restore service. MTD is the maximum time a function can be down before unacceptable harm. MTBF measures reliability between failures.
• 10. C. An expansionary appetite accepts higher risk to pursue growth and opportunity. A conservative appetite prefers stability and low risk, and a neutral appetite falls between the two. Residual describes risk remaining after treatment, not an appetite.
• 11. B, C. A formal, time-limited, approved deviation from a security requirement is an exception, a form of documented risk acceptance. Network isolation and monitoring substitute for the missing encryption, making them compensating controls. Avoidance would retire the system immediately. Transference would shift the financial risk to a third party. Exposure factor is a quantitative analysis input, not a treatment.
• 12. B. Key risk indicators are metrics recorded in the register that signal when a risk is increasing, such as backup failure rates and EDR coverage. Exposure factor and SLE are quantitative analysis values that do not themselves trend over time. The risk appetite statement defines how much risk the organization will tolerate; it does not detect changes in a specific risk.