CISMP (Certificate in Information Security Management Principles) Information Risk Management Syllabus

What is the difference between 'risk analysis' and 'risk evaluation'?

Risk analysis estimates the level of each risk (combining likelihood and impact). Risk evaluation compares those analysed levels against risk criteria/appetite to decide which risks need treatment and to prioritise them.

Contrast qualitative and quantitative risk analysis.

Qualitative uses descriptive scales (e.g. High/Medium/Low) and is quick and subjective. Quantitative assigns numeric/monetary values (e.g. SLE, ALE) and is more objective but data-hungry and time-consuming.

In quantitative risk analysis, what is the Single Loss Expectancy (SLE) and its formula?

SLE is the expected monetary loss from a single occurrence of a risk. $$\text{SLE} = \text{Asset Value} \times \text{Exposure Factor (EF)}$$

Define the Exposure Factor (EF) in quantitative risk analysis.

The proportion of an asset's value that is lost in a single incident, expressed as a percentage (or fraction), e.g. $EF = 0.4$ means 40% of the asset value is lost.

What is the Annualised Rate of Occurrence (ARO)?

The estimated number of times a given risk event is expected to occur in one year (e.g. $ARO = 0.5$ means once every two years).

State the formula for Annualised Loss Expectancy (ALE).

$$\text{ALE} = \text{SLE} \times \text{ARO}$$ It gives the expected monetary loss per year and is a key input to cost-benefit decisions on controls.

A server worth £50,000 has an exposure factor of 0.2 and an ARO of 2. Calculate the ALE.

$SLE = £50{,}000 \times 0.2 = £10{,}000$; $ALE = £10{,}000 \times 2 = £20{,}000$ per year.

What is a 'risk matrix' (heat map) and how is it used?

A grid plotting likelihood against impact, each cell coloured (typically red/amber/green) to show risk severity. It supports qualitative risk evaluation and prioritisation.

List the four main risk treatment options.

1) Treat/Modify (reduce via controls), 2) Tolerate/Accept (retain the risk), 3) Transfer/Share (e.g. insurance, outsourcing), 4) Terminate/Avoid (stop the activity). Often remembered as the '4 Ts'.

What does 'risk transfer' (sharing) involve, and does it remove all risk?

Passing some or all of the risk to a third party, e.g. via insurance or outsourcing. It does not remove accountability/residual risk — reputational and legal responsibility usually remain with the organisation.

When is 'risk avoidance' (terminate) appropriate?

When a risk is unacceptable and cannot be cost-effectively reduced or transferred — the organisation withdraws from, or chooses not to start, the activity that gives rise to the risk.

What is risk acceptance (tolerate) and what is required for it?

A decision to retain a risk without further treatment, usually because it falls within risk appetite or treatment is not cost-effective. It requires formal, documented sign-off by the appropriate risk owner/management.

Who is a 'risk owner'?

The person or entity with the accountability and authority to manage a particular risk — responsible for ensuring it is treated appropriately and for accepting residual risk.

Define 'stakeholder' in the risk management context.

Any person or organisation that can affect, be affected by, or perceive themselves to be affected by a risk or a risk decision — e.g. senior management, staff, customers, regulators, suppliers, shareholders.

What is the SIRO (Senior Information Risk Owner) and where is the role common?

A board-level executive accountable for an organisation's information risk overall, championing information risk management and owning the information risk policy. The role is common in UK government/public sector.

What is an Information Asset Owner (IAO)?

An individual accountable for a specific information asset — understanding what information is held, how it is used and shared, and ensuring risks to that asset are managed and reported to the SIRO.

What is the purpose of 'risk monitoring and review'?

To ensure risk assessments remain current and controls remain effective — detecting changes in threats, vulnerabilities, assets, context or appetite, and confirming treatments are working. Risk management is a continuous, iterative cycle.

Name events that should trigger a review of a risk assessment.

Significant changes to the business, new technology or systems, new or changed threats, security incidents, audit findings, changes in legislation/regulation, or expiry of a defined review period.

What is a 'risk register'?

A documented record of identified risks including their description, owner, likelihood, impact, risk level, chosen treatment, controls, residual risk and review status. It is a key monitoring and reporting tool.

Which ISO/IEC standard provides guidance specifically on information security risk management?

ISO/IEC 27005 — it provides guidelines for information security risk management and supports the implementation of an ISMS based on ISO/IEC 27001.

How does ISO/IEC 27005 relate to ISO/IEC 27001 and ISO 31000?

ISO/IEC 27005 gives detailed information-security-specific risk guidance supporting the ISMS requirements of ISO/IEC 27001, and aligns with the generic, organisation-wide risk management framework of ISO 31000.

What is ISO 31000?

An international standard providing principles, a framework and a process for managing risk of any kind across an organisation. It is generic (not IT-specific) and underpins sector standards like ISO/IEC 27005.

What does ISO/IEC 27001 require regarding risk?

It requires organisations to establish a risk assessment and risk treatment process, define risk criteria, produce a Statement of Applicability, and obtain risk owners' approval of the risk treatment plan and acceptance of residual risks.

What is the NIST framework most associated with risk management, and its key publications?

The NIST Risk Management Framework (RMF), supported by SP 800-30 (risk assessment guidance), SP 800-37 (the RMF process) and SP 800-39 (managing information security risk).

Name recognised risk management methodologies/frameworks used in information security.

ISO/IEC 27005, ISO 31000, NIST RMF (SP 800-30/37/39), OCTAVE, COSO ERM, and historically the UK government method CRAMM.

What is a Statement of Applicability (SoA) in ISO/IEC 27001?

A documented statement listing the Annex A controls, whether each is applied, the justification for inclusion or exclusion, and the implementation status — linking selected controls to the risk treatment plan.

What does 'cost-benefit analysis' mean when selecting controls?

Comparing the cost of implementing and operating a control against the benefit it provides (the reduction in expected loss, e.g. reduction in ALE). A control is justified only if its benefit outweighs its cost.

Define the principle of 'proportionality' in risk treatment.

Controls and effort should be proportionate to the level of risk and the value of the asset — you should not spend more protecting an asset than the asset (and its risk) is worth, nor under-protect high-value assets.

How do you decide whether a control is cost-justified using ALE?

Calculate the ALE before and after the control; the annual benefit is the reduction in ALE. The control is justified if: $$(\text{ALE}_{\text{before}} - \text{ALE}_{\text{after}}) > \text{annual cost of control}$$

In the context of accreditation, what is 'accreditation' (authorisation to operate)?

The formal management decision and authorisation by a senior responsible owner to operate a system, having reviewed and explicitly accepted the residual risks against defined security requirements.

What is the difference between accreditation and certification?

Certification is the technical assessment confirming a system meets defined security requirements/controls; accreditation is the management decision to accept the residual risk and authorise the system to operate based on that certification evidence.