3.1Risk management

Information security practice does not aim to eliminate every risk to zero. Budget, staffing, and business impact are all limited, and the purpose of risk management is to rationally decide how to allocate limited resources across risks. As a Registered Information Security Specialist, you must be able to explain to management and system departments why a particular treatment was chosen for a given risk. This section covers the reasoning behind these choices, from inventorying information assets through selecting a risk treatment.

3.1.1Classifying information assets

• An information asset is anything an organization holds that must be protected—data, information systems, storage media, and the like. The first step of risk management is to build an information asset inventory and classify each asset's importance from the perspective of confidentiality, integrity, and availability (CIA).
• Classifying asset importance is the basis for deciding, during the subsequent risk assessment, which assets to evaluate first. Higher-importance assets—such as a database containing customers' personal information—require more detailed analysis and more robust countermeasures.

3.1.2The risk assessment procedure

• Risk assessment consists of three stages. (1) Risk identification: identify which threats and vulnerabilities could affect which assets. (2) Risk analysis: evaluate the likelihood and impact of each identified risk to compute a risk level. (3) Risk evaluation: compare the computed risk level against risk acceptance criteria to determine whether treatment is required.
• Qualitative risk analysis evaluates risk using a relative scale such as "high/medium/low." It is well suited to quickly screening a large number of risks. Quantitative risk analysis estimates loss amounts and likelihood in monetary or numerical terms (e.g., Annualized Loss Expectancy, ALE). It is more persuasive when explaining risk to management or comparing return on security investment, but gathering accurate data costs more time and money.

3.1.3Risk treatment (transfer, avoidance, acceptance, reduction)

• Risk reduction (mitigation) introduces controls (access control, encryption, etc.) to lower the likelihood or impact itself, and is the most common treatment. Risk avoidance discontinues or changes the business activity or service that is the source of the risk, removing the risk's origin entirely.
• Risk transfer (sharing) spreads the impact of a risk (primarily financial loss) outside the organization, for example via cyber insurance or by using outsourcing/cloud services. Note, however, that accountability itself cannot be transferred. Risk acceptance deliberately takes no action and tolerates the risk when its level is within acceptance criteria, or when the cost of countermeasures would exceed the expected loss.
• The four treatments are not mutually exclusive and are often combined in practice. For example, a personal-data-leakage risk might be reduced through access controls while the remaining loss risk is layered with transfer via cyber insurance—this kind of multi-layered design is common in practice.

Suppose a security officer at an online payment provider is weighing treatments for three risks: (1) a vulnerability in the API for an old payment terminal (very few users remain, but exploitation could enable fraudulent transfers), (2) total loss of a data center from a large-scale natural disaster (low probability but massive impact), and (3) compliance risk from underdeveloped regulation in a specific emerging market where the service operates (the risk persists as long as the service continues in that market). For (1), decommissioning the low-impact legacy API eliminates the vulnerability itself, making risk avoidance the optimal treatment (more fundamental than reduction via patching). For (2), the impact is massive but the probability is low, and the organization cannot fully prevent the event alone, so spreading the financial impact externally via business-continuity insurance or reinsurance—risk transfer—is realistic (comparing the premium against the expected loss before contracting). For (3), removing the risk's source (continuing operations in that market) would resolve it, but if withdrawal is not viable for the business, the organization instead strengthens its compliance posture (hiring local experts, building a regulatory-monitoring capability) to lower likelihood and impact—risk reduction—and then obtains management approval to accept the remaining residual risk, a staged judgment call. Even for the same task of "deciding on a treatment," the optimal choice shifts along axes such as whether the organization itself can remove the risk's source, whether the impact can be monetized or externalized, and how much of the remainder can be tolerated.

3.1.4Residual risk, the risk matrix, and JIS Q 31000

• Residual risk is the risk that remains after a treatment (such as reduction) has been applied. Risk rarely reaches zero after treatment, so management needs a mechanism to recognize the residual risk and decide whether further treatment or acceptance is warranted.
• A risk matrix plots likelihood on one axis and impact on the other, visualizing risk level (priority) from their combination. It serves as a shared vocabulary for explaining to management which risks (those with high likelihood and high impact) require priority treatment.
• JIS Q 31000 is the Japan Industrial Standard corresponding to the international risk management standard (ISO 31000). It defines a framework of risk management principles and processes applicable to any risk across an entire organization—management, financial, information security, and more—not limited to a specific industry or to ISMS alone.

3.1.5Section summary

• Risk assessment proceeds in three stages: risk identification -> risk analysis (qualitative/quantitative) -> risk evaluation
• Risk treatment is chosen by situation among reduction (lower via controls), avoidance (remove the source), transfer (externalize the impact), and acceptance (tolerate as is)
• Residual risk normally remains after treatment; it is visualized with a risk matrix and management decides on acceptance. The overall framework is JIS Q 31000