Rules first, the risk second
Before assessing anything you agree on the criteria: a likelihood scale, an impact scale and a matrix that turns the two into a zone (Low, Moderate, High or Extreme). If two people assess the same risk with different rules, the result can be neither compared nor defended before an auditor.
A well-written risk answers five questions
- Which asset is affected.
- Which threat acts.
- Which weakness it exploits.
- What is lost: confidentiality, integrity or availability.
- Who is accountable for it.
“Cyber attack” can be neither assessed nor treated. “Takeover of the cloud console with a stolen admin account” can.
Inherent risk: before counting the controls
It is measured without controls on purpose: that is how you know how much they contribute and what gap is left if one stops working. Likelihood is answered with an expected frequency. Impact is assessed on four dimensions (financial, reputation, legal and operational) and the highest one counts, not the average: a risk that costs little money but destroys reputation is still serious.
A cloud software company assesses the theft of an admin account. Likelihood 3: it can happen once a year. Impacts: financial 4, reputation 5, legal 4 and operational 5, so impact is 5. On its matrix, likelihood 3 with impact 5 falls in the Extreme zone.
Controls are rated, not counted
A control is something the organization already does; what it plans to do belongs in the action plan. Preventive controls lower likelihood and corrective controls lower impact. Each one is rated with specific questions: how often it runs, how much of the risk it covers, who runs it, whether it depends on someone remembering and whether it leaves evidence. Ten weak controls can reduce less than one done well.
Access rules (preventive) score 55.5 points and lower likelihood by one level, from 3 to 2. Backups (corrective) score 62 points and lower impact by two levels, from 5 to 3.
Residual risk is calculated
With the controls rated, the risk is placed on the matrix again: likelihood 2 with impact 3, Moderate zone. That result is not typed in by hand. The most common vice of spreadsheet matrices is to enter a low residual because it “feels” controlled.
The zone decides what comes next
- Low: accepted as is and reviewed every six months.
- Moderate: reduced, or accepted with monitoring; reviewed every three months.
- High: action plan or formal acceptance; reviewed every two months.
- Extreme: action plan or formal acceptance; reviewed every month.
A formal acceptance carries a justification, minutes and signatures, and whoever drafts it does not approve it. An action plan says what will be done, who is accountable and when it ends.
This is the path followed by Risk, the tool The Ark of ISO offers for assessing and treating risks.