Risk Management — Part A

Information risk is the chance that a threat exploits a vulnerability and harms an information asset — conceptually probability × impact. Managing it is a continuous lifecycle, not a project: identify → assess/analyze → treat → monitor & report, then repeat as conditions change.

• Inherent risk is the exposure before controls; residual risk is what remains after them.
• The business defines appetite (risk it will accept), tolerance (acceptable variation), and capacity (maximum it could absorb).
• Risk is a business decision: security manages the process and advises; the business sets appetite and accepts residual risk.
• A healthy risk culture, driven from the top, makes risk-aware decisions the norm rather than the exception.

Information security risk does not stand alone — it is one input into enterprise risk management (ERM), which gives leadership a single, consolidated view of all business risk. Aligning to ERM keeps security risk in business language and on the board’s agenda.

• The risk register records each risk with its owner, likelihood, impact, treatment, and status; the aggregate is the risk profile. (continues in Lesson 3 — analyzing & treating risk)
• The risk owner is the business leader accountable for the risk; the control owner runs a specific mitigating control.
• Risk reporting rolls up to leadership in terms of business impact — not raw vulnerability counts.
• Integrating with ERM avoids security risk being managed in a silo and lets the board weigh it against other enterprise risks.

Risk is always risk to an asset. Before anything can be assessed or protected, the organization must know what information assets it has and who owns them. An incomplete asset inventory is the root cause of blind-spot risk.

• Information assets include data, applications, systems, and supporting people and processes — not just servers.
• The data owner is a business role: they classify the data and authorize who may access it.
• The custodian (often IT) implements and maintains the protection according to the owner’s classification.
• A maintained asset inventory is the foundation of classification, valuation, and risk assessment.

Classification assigns each information asset a sensitivity level based on the impact of its loss. Once classified, handling, storage, access, and protection requirements follow automatically — classification is what makes consistent protection scalable.

• Typical schemes use tiers such as public, internal, confidential, restricted — simpler is better; too many tiers fail in practice.
• Classification is driven by impact to confidentiality, integrity, and availability, judged in business terms.
• Each level maps to defined handling rules (encryption, access, retention, disposal).
• Over-classification wastes resources and breeds workarounds; under-classification leaves data exposed — both are governance failures.

Valuation tells the organization how much protection an asset justifies and feeds directly into risk analysis and prioritization. The CISM cares less about a precise dollar figure than about valuing assets consistently in business terms.

• Quantitative valuation expresses worth in money — replacement cost, lost revenue, regulatory fines, recovery cost.
• Qualitative valuation rates business impact as high/medium/low when hard numbers are impractical.
• Value should reflect business impact (including reputation and legal exposure), not just the technical cost of the asset.
• Asset value and classification together drive how much to invest in protecting each asset — the most valuable, most sensitive assets get the most rigor.

Try it — value an asset and let it classify itself

Rate the business impact of losing an asset’s confidentiality, integrity, and availability, add its replacement cost and any regulatory exposure, and watch its classification and value fall out — because the classification follows the highest impact dimension, and protection should be proportionate to value.