2 Risk Management

Cybersecurity risk management begins with the idea that organizations cannot protect everything equally because assets, threats, vulnerabilities, and resources all vary. The chapter explains that risk is not just danger in a general sense, but a combination of how harmful an event could be and how likely it is to happen. This makes it necessary to move beyond intuition and use structured decision-making when choosing which assets and vulnerabilities deserve attention first.

To support that judgment, the chapter distinguishes between impact and likelihood. Impact reflects the magnitude of harm an adverse event could cause to systems, operations, people, and third parties, while likelihood reflects the probability that a threat will successfully exploit a vulnerability. The text shows that neither factor alone is enough for prioritization, so organizations use qualitative methods, quantitative methods, or both. Qualitative analysis often relies on categories such as low, medium, high, or very high, while quantitative analysis uses numeric measures such as asset value, exposure factor, single loss expectancy, annualized rate of occurrence, and annualized loss expectancy. Risk matrices help translate these assessments into comparable risk levels and guide prioritization.

The chapter then frames risk management as an ongoing process rather than a one-time exercise. It covers risk assessment, which includes identifying assets, threats, vulnerabilities, and existing controls, and risk treatment, which turns evaluation results into action. Organizations may mitigate, avoid, transfer, or accept risk depending on their appetite and tolerance, their strategic goals, and practical constraints such as cost, usability, and compliance. Because controls never eliminate risk entirely, residual risk remains after treatment and must be monitored continuously. The overall goal is not zero risk, but a defensible balance that protects critical assets while using resources wisely.

Illustration of the risk in terms of likelihood and impact

Risk as function of likelihood and impact

Illustration of the risk management process

A risk matrix displaying the level of risk as a function of the of likelihood and impact

Risk decision bands according to likelihood and impact

Illustration of the concept of “residual risk”

1. The correct answer is B. The purpose of any insurance is to transfer risk from one party to another and this process is called risk transference. The insurer is obligated to compensate the insured for a loss caused by an unexpected event over a specified and mutually agreed upon period of time.
2. The correct answer is A. Risk management is a proactive process of identifying, assessing and prioritizing risks. Appropriate controls are then selected and implemented to reduce or mitigate the potential impact of identified risks. On the other hand, eliminating all risks is impractical, minimizing implementation costs can expose an organization to unnecessary risk, and focusing solely on reactive countermeasures runs counter to the principles of comprehensive risk management.
3. The correct answer is D. Risk acceptance is a risk management strategy in which an organization chooses not to implement controls to address a risk, but instead accepts the risk and its potential consequences. This doesn't mean that the company ignores the risk; rather, it has made a conscious decision to accept it after considering the costs and benefits.
4. The correct answer is A. Residual risk helps organizations understand the remaining level of risk they face after implementing their chosen controls and countermeasures, enabling them to make informed decisions about whether additional action is needed or whether the remaining risk is acceptable. None of the other options accurately describe the concept of residual risk.
5. The correct answer is A. Risk mitigation involves implementing strategies to limit the impact or likelihood of threats occurring. Risk acceptance, on the other hand, is a conscious decision to acknowledge a risk but not take immediate action.

FAQ