Cyberstudy
PDF p.400 In progress

Risk Management Processes

Open PDF at p.400 29 flashcards

Summary

PDF p.400

Risk management involves identifying, assessing, and mitigating vulnerabilities and threats to essential business functions. The process is typically performed over five phases: identifying mission essential functions, identifying vulnerabilities, identifying threats, analyzing business impacts, and identifying risk responses.

In plain words

Supplementary — not from your PDF

The five-phase process: identify mission essential functions, identify vulnerabilities, identify threats, analyze business impacts (likelihood and impact), then identify risk responses. Enterprise Risk Management (ERM) formalizes this using frameworks such as NIST RMF or ISO 31000. A risk register records each risk's severity, owner and mitigation. A risk threshold sets the acceptable limit; key risk indicators (KRIs) give early warning; each risk has an owner. Risk appetite can be expansionary, conservative or neutral.

Detailed explanation

PDF p.400
  • Identify Mission Essential Functions
    • Definition: Focus on functions critical to business survival.
    • Importance: Ensures efforts and resources are directed towards functions that could cause business failure if not performed.
    • Process: Identify critical systems and assets supporting these functions.
  • Identify Vulnerabilities
    • Definition: Analyze systems and assets to discover weaknesses.
    • Process: Start with the most critical functions and list any vulnerabilities.
  • Identify Threats
    • Definition: Identify sources and actors that could exploit vulnerabilities.
    • Process: Assess threats for each function or workflow.
  • Analyze Business Impacts
    • Definition: Assess the likelihood and impact of vulnerabilities being exploited.
    • Methods: Use quantitative and qualitative methods to analyze impacts and likelihood.
  • Identify Risk Response
    • Definition: Determine countermeasures and assess the cost of additional security controls.
    • Process: Identify appropriate responses for each risk, including mitigation, avoidance, transference, or acceptance.
  • Likelihood and Impact
    • Likelihood: Describes the chance of a risk event happening, expressed qualitatively (low, medium, high) or quantitatively (0 to 1 or percentage).
    • Impact: Severity of the risk if realized, determined by asset value or disruption cost.
  • Enterprise Risk Management (ERM)
    • Definition: Policies and procedures based on frameworks like NIST RMF or ISO 31K.
    • Process: Formalized as Risk and Control Self-Assessment (RCSA) or led by external parties as Risk and Control Assessment (RCA).
  • Risk Registers
    • Definition: Document showing risk assessments, including severity, owner, and mitigation strategies.
    • Formats: Heat map risk matrix or scatterplot graphs.
    • Purpose: Shared among stakeholders to understand associated risks.
  • Risk Threshold
    • Definition: Limits of acceptable risk an organization is willing to tolerate.
    • Factors: Based on regulatory requirements, objectives, stakeholder expectations, and risk appetite.
  • Key Risk Indicators (KRIs)
    • Definition: Predictive indicators to monitor and predict potential risks.
    • Purpose: Provide early indication of increasing risk exposures.
  • Risk Owner
    • Definition: Individual responsible for managing a particular risk.
    • Role: Identify, assess, mitigate, monitor, and communicate risk status.
  • Risk Appetite
    • Definition: Level of risk an organization is willing to accept.
    • Comparison: Risks are compared to risk appetite to determine management and monitoring priorities.
  • Levels of Risk Appetite
    • Expansionary: Willing to take higher risks for high returns or growth.
    • Conservative: Prioritizes risk avoidance and cautious approach.
    • Neutral: Balances expansionary and conservative approaches.
  • Risk Reporting
    • Definition: Methods to communicate risk profile and management effectiveness.
    • Purpose: Supports decision-making and ensures stakeholders understand risks.

Important terms

taken from the text above
Identify Mission Essential Functions
Focus on functions critical to business survival.
Identify Vulnerabilities
Analyze systems and assets to discover weaknesses.
Identify Threats
Identify sources and actors that could exploit vulnerabilities.
Analyze Business Impacts
Assess the likelihood and impact of vulnerabilities being exploited.
Identify Risk Response
Determine countermeasures and assess the cost of additional security controls.
Likelihood
Describes the chance of a risk event happening, expressed qualitatively (low, medium, high) or quantitatively (0 to 1 or percentage).
Enterprise Risk Management (ERM)
Policies and procedures based on frameworks like NIST RMF or ISO 31K.
Risk Registers
Document showing risk assessments, including severity, owner, and mitigation strategies.
Formats
Heat map risk matrix or scatterplot graphs.
Risk Threshold
Limits of acceptable risk an organization is willing to tolerate.
Key Risk Indicators (KRIs)
Predictive indicators to monitor and predict potential risks.
Risk Owner
Individual responsible for managing a particular risk.
Risk Appetite
Level of risk an organization is willing to accept.
Comparison
Risks are compared to risk appetite to determine management and monitoring priorities.
Expansionary
Willing to take higher risks for high returns or growth.
Conservative
Prioritizes risk avoidance and cautious approach.
Neutral
Balances expansionary and conservative approaches.
Risk Reporting
Methods to communicate risk profile and management effectiveness.
ERM Enterprise Risk Management RCSA Risk and Control Self-Assessment RCA Risk and Control Assessment KRIs Key Risk Indicators

Examples & real-world scenarios

Supplementary — not from your PDF
  • A risk register listing severity, owner and mitigation for each risk.
  • KRIs flagging rising risk before it's realized.
  • Using NIST RMF as the ERM framework.

Scenario

A risk register shows a high-severity risk with no owner. Assigning a risk owner makes someone accountable for mitigating, monitoring and reporting it.

Common mistakes

Supplementary — not from your PDF
  • Skipping mission essential functions and assessing everything equally.
  • Having a risk register with no named owners.

Practical skills

Supplementary — not from your PDF
  • List the five risk management phases.
  • Explain what a risk register contains.

What I should remember

Key Points PDF p.400
  • Identify Mission Essential Functions
    • Focus Efforts: On critical functions and supporting systems.
  • Identify Vulnerabilities
    • Analyze Systems: Discover and list weaknesses.
  • Identify Threats
    • Assess Threats: For each function or workflow.
  • Analyze Business Impacts
    • Assess Likelihood and Impact: Using quantitative and qualitative methods.
  • Identify Risk Response
    • Determine Countermeasures: Assess cost and appropriateness.
  • Likelihood and Impact
    • Likelihood: Qualitative or quantitative measure.
    • Impact: Severity based on asset value or disruption cost.
  • Enterprise Risk Management (ERM)
    • Policies and Procedures: Based on frameworks like NIST RMF or ISO 31K.
  • Risk Registers
    • Document Risks: Include severity, owner, and mitigation strategies.
  • Risk Threshold
    • Acceptable Limits: Based on various factors.
  • Key Risk Indicators (KRIs)
    • Predictive Indicators: Monitor and predict risks.
  • Risk Owner
    • Manage Risks: Identify, assess, mitigate, monitor, and communicate.
  • Risk Appetite
    • Acceptable Risk Level: Compare risks to determine priorities.
  • Levels of Risk Appetite
    • Expansionary: High risk for high returns.
    • Conservative: Risk avoidance.
    • Neutral: Balanced approach.
  • Risk Reporting
    • Communicate Risks: Support decision-making and stakeholder understanding.