CoreQ Academy5.2 Explain elements of the risk management process.
Risk management decides where to spend limited security effort. Identify risks, measure them, decide how to treat them and track them over time.
Identification and assessment
- Risk identification
- Finding risks through assessments, threat intel, audits and incidents.
- Ad hoc
- An assessment done when needed, for example after a major change.
- Recurring
- Assessments repeated on a schedule.
- One-time
- A single assessment for a specific project.
- Continuous
- Ongoing automated risk monitoring.
Risk analysis
- Qualitative
- Rating risk with categories (high/medium/low) using judgment.
- Quantitative
- Calculating risk in numbers, usually money.
- Single loss expectancy (SLE)
- Loss from one event: asset value × exposure factor.
- Annualized loss expectancy (ALE)
- Expected loss per year: SLE × ARO.
- Annualized rate of occurrence (ARO)
- How many times per year the event is expected.
- Probability
- Statistical chance of an event occurring.
- Likelihood
- How likely the event is, often expressed qualitatively.
- Exposure factor
- Percentage of asset value lost in one event.
- Impact
- The consequence if the risk happens.
Risk register
- Risk register
- A record of identified risks, their ratings, owners and treatments.
- Key risk indicators
- Metrics that warn a risk is increasing, such as the number of overdue critical patches.
- Risk owners
- People accountable for managing each risk.
- Risk threshold
- The level at which a risk requires action or escalation.
Tolerance and appetite
- Risk tolerance
- The acceptable variation around the appetite for a specific risk.
- Risk appetite
- How much risk the organisation is willing to take to achieve its goals.
- Expansionary
- Willing to accept more risk for growth.
- Conservative
- Prefers low risk even at the cost of opportunity.
- Neutral
- Balanced approach.
Risk management strategies
- Transfer
- Shift financial impact to another party, such as insurance or a contract.
- Accept
- Acknowledge the risk and take no further action because it is within appetite or too costly to treat.
- Exemption
- Formal permission that a requirement does not apply.
- Exception
- Formal, time-limited approval to not meet a requirement, usually with compensating controls.
- Avoid
- Stop the activity that creates the risk.
- Mitigate
- Apply controls to reduce likelihood or impact.
Risk reporting and business impact analysis
- Risk reporting
- Communicating risk status to leadership and stakeholders.
- Business impact analysis
- Identifies critical processes and the impact of their disruption to set recovery priorities.
- Recovery time objective (RTO)
- The maximum acceptable time to restore a process after disruption.
- Recovery point objective (RPO)
- The maximum acceptable data loss measured in time (how old the last good backup can be).
- Mean time to repair (MTTR)
- Average time to fix a failed component.
- Mean time between failures (MTBF)
- Average time a repairable system runs between failures; a reliability measure.
A server worth $50,000 would lose 40% of its value in a flood. Floods are expected once every 10 years. Calculate SLE and ALE.
Show answer
SLE = $50,000 × 0.40 = $20,000. ARO = 0.1. ALE = $20,000 × 0.1 = $2,000 per year. Spending more than about $2,000 a year to mitigate this alone would not be cost-justified.
Check your understanding
Knowledge quiz · pass mark 80%
- SLE is $10,000 and the event happens twice a year. ALE is:
- The business can lose at most 4 hours of data. This defines the:
- Buying cyber insurance is which strategy?
- Stopping use of a risky legacy service entirely is:
- A risk register records risks, owners and how each risk is being treated.
- Asset value $100,000, exposure factor 25%. What is the SLE?
Original CoreQ Academy material, mapped to objective 5.2 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.