Certified Information Security Manager (CISM) Information Security Risk Assessment Syllabus

Information Security Risk Assessment syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Information Security Risk Assessment in Certified Information Security Manager (CISM), not a summary of it.

1. 1

   Risk Concepts and the Risk Landscape

   4 topics

   • Core Risk Terminology
     • Threats, vulnerabilities, assets, and impact
     • Inherent, residual, and aggregate risk
   • Risk Appetite and Tolerance
     • Establishing acceptable risk levels
     • Aligning appetite with business objectives
   • Emerging Threats and Vulnerabilities
     • Threat intelligence and threat actor profiling
     • Supply chain and third-party risk
   • Risk Management Frameworks
     • NIST SP 800-39 and ISO/IEC 27005
     • FAIR quantitative risk modeling
2. 2

   Asset Identification and Valuation

   3 topics

   • Asset Inventory and Classification
     • Asset ownership and stewardship
     • Information classification schemes
   • Business Impact Considerations
     • Determining asset criticality
     • Valuation methods for tangible and intangible assets
   • Data Lifecycle and Protection Needs
     • Data states and handling requirements
     • Retention and disposal considerations
3. 3

   Risk Identification and Analysis

   3 topics

   • Risk Identification Methods
     • Threat modeling and scenario analysis
     • Vulnerability assessment and penetration testing inputs
   • Risk Analysis Techniques
     • Qualitative vs. quantitative analysis
     • Single loss and annualized loss expectancy
   • Risk Evaluation and Ranking
     • Risk scoring and heat maps
     • Prioritization against risk criteria

Information Security Risk Assessment flashcards for Certified Information Security Manager (CISM)

21 of 51 cards from the Information Security Risk Assessment deck — real questions with worked answers.

1. What is the definition of a 'threat' in information security risk terminology?

   A threat is any potential cause of an unwanted incident that may result in harm to a system or organization, e.g., a hacker, malware, natural disaster, or insider.

2. What is a 'vulnerability' in risk terminology?

   A vulnerability is a weakness or flaw in an asset or control that can be exploited by a threat to cause harm (e.g., unpatched software, weak passwords).

3. Define 'risk' as used in information security.

   Risk is the potential that a given threat will exploit a vulnerability of an asset, resulting in loss or damage. It is a function of likelihood and impact.

4. What is an 'asset' in risk management?

   An asset is anything of value to the organization—data, hardware, software, people, reputation, or processes—that needs protection.

5. What is 'exposure' in risk terminology?

   Exposure is an instance of being susceptible to loss from a threat; the state of being unprotected against a particular vulnerability.

6. Define 'inherent risk' versus 'residual risk'.

   Inherent risk is the level of risk before any controls are applied; residual risk is the risk that remains after controls/mitigations have been implemented.

7. What is a 'control' (safeguard/countermeasure)?

   A control is a policy, procedure, practice, or technical mechanism that reduces risk by lowering the likelihood or impact of a threat exploiting a vulnerability.

8. What is the difference between a threat agent (threat actor) and a threat?

   A threat is the potential danger; a threat agent/actor is the entity (person, group, or thing) that carries out or triggers the threat.

9. Define 'likelihood' (probability) in risk assessment.

   Likelihood is the chance or frequency that a given threat will successfully exploit a vulnerability within a defined time period.

10. Define 'impact' in risk assessment.

    Impact is the magnitude of harm or loss resulting from a threat exploiting a vulnerability—measured in financial, operational, reputational, or regulatory terms.

11. What is 'risk appetite'?

    Risk appetite is the broad amount of risk an organization is willing to accept in pursuit of its objectives, set at the strategic level by senior management/board.

12. What is 'risk tolerance'?

    Risk tolerance is the acceptable level of variation (deviation) around specific objectives or risk types—a more granular, operational boundary than risk appetite.

13. How do risk appetite and risk tolerance differ?

    Risk appetite is the overall strategic amount of risk an organization will accept; risk tolerance is the acceptable deviation around specific objectives. Tolerance operationalizes appetite.

14. What is 'risk capacity'?

    Risk capacity is the maximum amount of risk an organization can absorb before threatening its viability—an objective limit, unlike appetite which is a chosen preference.

15. Who is ultimately responsible for setting an organization's risk appetite?

    The board of directors and senior management (executive leadership) set risk appetite, aligning it with business strategy and objectives.

16. Why must risk tolerance levels be documented and communicated?

    So that risk treatment decisions are consistent, risk owners know acceptable thresholds, and exceptions can be escalated when tolerance is exceeded.

17. What is an Advanced Persistent Threat (APT)?

    An APT is a stealthy, prolonged, and targeted cyberattack—typically by a well-resourced adversary—that gains and maintains unauthorized access to exfiltrate data over time.

18. What is a 'zero-day vulnerability'?

    A zero-day is a software flaw unknown to the vendor (or with no available patch) that attackers can exploit before a fix is released.

19. What is a 'supply chain attack' as an emerging threat?

    An attack that compromises an organization indirectly by targeting a trusted third-party vendor, software component, or service provider in its supply chain.

20. What distinguishes a vulnerability from an emerging threat in monitoring?

    A vulnerability is an existing weakness to be patched/mitigated; an emerging threat is a new or evolving danger (new malware, attack technique) requiring updated threat intelligence.

21. Why is threat intelligence important for managing emerging threats?

    It provides timely, actionable information about new attack vectors, actors, and indicators of compromise, enabling proactive defense before threats materialize.

See more Information Security Risk Assessment flashcards →

Planning Information Security Risk Assessment for Certified Information Security Manager (CISM)

Information Security Risk Assessment (Certified Information Security Manager (CISM)) FAQ