CRISC: Risk Assessment

Risk Identification (Domain 2A)

Risk Events

• Risk event: a situation where a threat exploits a vulnerability and causes impact to a business objective
• Categories: strategic, operational, financial, compliance, reputational
• IT risk event examples: data breach, system outage, unauthorized access, ransomware, insider threat
• Risk identification sources: past incidents, audit findings, vulnerability scans, threat intelligence, interviews, workshops
• Risk identification must be ongoing — not a one-time exercise

Threat Modeling and Threat Landscape

• Threat agent (actor): person or group with motive, means, and opportunity (external attacker, insider, nation-state)
• Threat landscape: current external environment of threat agents and their tactics (informed by threat intelligence)
• STRIDE model: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege
• PASTA (Process for Attack Simulation and Threat Analysis): risk-centric threat modeling methodology
• Threat intelligence sources: ISACs, CISA alerts, vendor advisories, dark web monitoring
• CRISC focus: linking threats to specific IT assets and business processes

Vulnerability Management

• Vulnerability: a weakness in technology, process, or people that can be exploited by a threat
• Technical vulnerabilities: unpatched software, misconfigured systems, weak credentials, legacy systems
• Process vulnerabilities: missing controls, inadequate segregation of duties, no change management
• Human vulnerabilities: lack of security awareness, social engineering susceptibility
• Vulnerability identification methods: penetration testing, vulnerability scanning, code reviews, audits
• CVSS (Common Vulnerability Scoring System): standard for rating technical vulnerability severity (0–10)

Risk Scenario Development and Evaluation

• Risk scenario components: Threat Actor + Threat Type + Asset/Resource + Impact type
• Example scenario: "An external attacker uses phishing to compromise a finance employee's credentials resulting in unauthorized wire transfers"
• Scenarios must be tied to specific business objectives to be relevant
• Scenario evaluation: assess likelihood and impact; produces risk score
• Risk scenarios are documented in the risk register
• ISACA recommends both top-down (from strategic objectives) and bottom-up (from assets/threats) approaches

Risk Analysis (Domain 2B)

Risk Assessment Concepts and Standards

• Risk assessment: the overall process of identifying, analyzing, and evaluating risk
• NIST SP 800-30: Guide for Conducting Risk Assessments — defines threat sources, events, vulnerabilities, likelihood, impact
• ISO/IEC 27005: Information security risk management standard (aligned with ISO 27001)
• OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation): asset-centric risk methodology
• FAIR (Factor Analysis of Information Risk): quantitative risk model — probability × magnitude of loss
• Key output: risk score/rating and risk register update

Business Impact Analysis (BIA)

• BIA: identifies critical business processes, their IT dependencies, and the impact of their disruption
• BIA outputs: critical process list, RTO and RPO for each, Maximum Tolerable Downtime (MTD), impact ratings (financial, operational, reputational)
• MTD: the absolute maximum time a business process can be unavailable before causing unacceptable damage
• BIA informs: BCP/DRP priorities, IT resilience investments, risk treatment priorities
• BIA must be performed before risk treatment planning — you cannot prioritize without knowing criticality

Risk Register

• Risk register: the central repository for all identified risks; a living document
• Standard fields: Risk ID, Risk Description, Risk Scenario, Risk Owner, Likelihood, Impact, Inherent Risk Score, Current Controls, Residual Risk Score, Risk Treatment, KRI, Due Date
• Risk register feeds into the risk profile (executive view)
• Maintained by the risk function, owned by risk owners
• Must be reviewed regularly (at minimum annually; after major incidents or changes)

Risk Analysis Methodologies

• Qualitative analysis: uses descriptive scales (High/Medium/Low; 1–5) for likelihood and impact; faster, subjective; most common in CRISC scenarios
• Quantitative analysis: uses numerical values and formulas; objective but data-intensive
• Semi-quantitative: combines descriptive ratings with numeric scores; hybrid approach
• Risk heat map / risk matrix: plots likelihood vs impact; visual tool for prioritization
• Exam tip: know ALE = ARO × SLE; know SLE = Asset Value × EF

Inherent and Residual Risk

• Inherent risk: the level of risk that exists WITHOUT any controls in place
• Residual risk: the level of risk AFTER controls are applied
• Target residual risk: the desired residual risk level (defined by risk appetite)
• Control gap: when residual risk exceeds target residual risk — triggers additional treatment
• Risk = Likelihood × Impact (foundational formula)
• CRISC candidates must be able to calculate and interpret all three risk levels