1-9 Flashcards
Define Risk.
Uncertainty of outcome
How do you assess risk?
By evaluating the culmination of likelihood of something happening and the impact if it does happen. (likelihood+impact)
What is risk volatility?
Describes the extent to which the level of risk is likely to change over time.
What is risk velocity?
Risk velocity is how fast an exposure can impact an organization
What is cascading risk?
Cascading risk is the principle that risks are linked and failing to address one can cause a chain reaction. 3 categories: parallel risk, serial risk, and mixed (combo of parallel and serial).
What is risk appetite?
Level of risk that an organization is comfortable engaging in. Determined by BoD. Categories include strategic, reputational, operational, financial, compliance, legal, and resilience.
What is risk tolerance?
Acceptable variation in outcomes based on a specific performance measure. Acceptable deviation from risk appetite!
What are the four processes in a risk assessment?
Identification, Analysis (likelihood, impact, and level), Evaluation (analysis comparison with appetite and tolerance), and Response.
Name some risk assessment frameworks
NIST RMF (Risk Management Framework), NIST SP800-30 (Risk assessments), ISO 31000, OCTAVE (Operationally Critical Threat, Asset, and Vuln Assessment), and COBIT 2019.
What is a risk analysis and its outcome?
Process by which likelihood, impact, and level of risk are determined. The outcome includes inherent and residual risks.
AV (in risk analysis)?
Asset Value
EF?
Exposure Factor
SLE?
Single Loss Expectancy.
ARO?
Annualized rate of occurrence
ALE
Annualized loss expectancy
How is SLE calculated?
AV * EF
How ALE calculated?
SLE * ARO
What is risk response?
Responsibility to determine how to respond to the outcome of a risk analysis
What are the four risk treatment options?
Avoid/terminate, transfer, mitigate, or accept?
What is risk transfer?
Usually accomplished by insurance. Used when likelihood is low but impact is high.
What is risk mitigation?
Reduction or risk by implementing controls, countermeasures, or process changes.
What is risk exception vs risk exemption
Exception is an acknowledgement of identified risk but approving it temporarily or permanently. Exemption is to not address the risk at all, deeming it too low of a chance or too high of expense/effort to mitigate.
What are the control classifications?
Deterrent, Preventative, Detective, Corrective, Compensating
