Risk Management

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

Included in this chapter:

Response	What you do	Typical example	Best when
Avoid	Stop the risky activity so the risk no longer exists	Drop a feature that collects data you do not need	The activity is not worth the risk it creates
Mitigate (reduce)	Add controls that lower likelihood or impact	Encryption, backups, patching, training	The activity must continue but risk is too high (most common)
Transfer (share)	Shift the financial impact to another party	Buy cyber insurance or use a third-party service	The loss is better borne by an insurer or partner
Accept	Knowingly live with the remaining risk	Document and accept a low-impact risk	Treatment would cost more than the potential harm

Cheat sheet

Risk needs a threat, a vulnerability, and an asset to line up
A vulnerability is a weakness, a threat is what acts on it, and risk is the chance of harm
Risk is sized by likelihood and impact together
Qualitative analysis ranks risk in bands; quantitative analysis puts money on it
The risk process loops: identify, assess, treat, monitor
You cannot manage a risk you have never identified
There are exactly four ways to treat a risk
Avoid a risk by stopping the activity that creates it
Mitigate by adding controls, the most common response
Transfer moves the financial impact, not the accountability
Accepting a risk is a deliberate, documented decision
Senior leadership accepts residual risk, not the analyst
Risk tolerance sets how much risk the organization will accept
Risk priorities steer scarce security resources
You cannot remove all risk, so manage it down to tolerance
Match the scenario verb to the right treatment
An asset's criticality comes from its impact on the mission, not its hardware
Value an information asset by the impact of losing its confidentiality, integrity, or availability
Annual Loss Expectancy is SLE times ARO
Continuous monitoring checks that controls stay effective over time
Report risk to leadership in business and financial terms

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet