Domain 1 · Objective reference 1.2 · Chapter 2 of 19
Risk management from scenario to review
About 6 minutes · ISC2 CC outline effective 1 September 2026
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Name the scenario before assigning a score.
Explore the anchors
Describe asset threat and consequence.
Concept matching activity
Match this task or description to its concept:
Estimate likelihood and impact.
Choose a concept before checking the explanation.
Risk-estimate sandbox
A fictional interruption costs the same amount per occurrence. Change the loss and expected annual frequency. This simplified annual loss expectancy model excludes uncertainty, correlated events and changing severity.
Annual loss expectancy = 10,000 × 2 = 20,000 units/year.
Ask what evidence supports both inputs. A precise arithmetic result does not make an uncertain estimate certain. Treatment cost alone is not the only decision criterion.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Describe risk before rating it
- Treat, monitor and reassess
- Use a simple scenario register
Describe risk before rating it
An asset is something of value, including information, a service or a capability. A threat is a potential cause of harm; a vulnerability is a weakness that may be used or triggered; an impact is the consequence. Risk reasoning connects these with the likelihood of a scenario. A vulnerability is not itself a completed incident, and the same weakness can have different consequences on a test device and a critical production service.
Start with scope and context: which service, whose objective, what time horizon and which assumptions? Identify scenarios, analyze likelihood and consequences, evaluate them against agreed criteria, select responses, assign owners and monitor changes. Communication and consultation support every stage. A junior analyst gathers reliable evidence and escalates through the defined route rather than independently accepting business exposure.
Treat, monitor and reassess
Mitigation changes likelihood or consequence through controls. Avoidance removes the activity creating the exposure. Transfer allocates some financial or contractual effects, while acceptance retains exposure through an authorized decision. Insurance does not restore an interrupted service or remove every legal duty. Residual risk remains after considering the controls that actually work; planned controls should be distinguished from operating ones.
Record the owner, response, deadline, verification method and review trigger. A supplier change, new application function or control failure can require reassessment before the normal review date. Qualitative labels help organize judgments but are not automatically financial quantities. Quantitative estimates also depend on assumptions and incomplete evidence. Explain uncertainty rather than treating a score as a precise forecast.
Use a simple scenario register
A practical record can contain: service, scenario, weakness, existing safeguards, likelihood rationale, consequence, owner, response and review date. For example, an internet-facing order service with an unsupported component may be interrupted by exploitation. Check reachability and current defenses rather than treating component age as a complete risk statement.
Keep inherent and residual assessments distinguishable. If a mitigation is proposed but not implemented, report the current exposure and the expected future state separately. Reassess after evidence shows that the control operates. Risk registers help communication, but a completed form without an accountable response can leave the exposure unchanged.
Worked example
A small retailer has an unpatched ordering server. Its risk scenario is interruption of online orders through exploitation of that server. The owner compares patching with a tested temporary restriction, documents residual exposure and sets a deadline to verify the permanent fix.
Check your understanding
A team accepts a risk because a safeguard will be delivered next month. What must the record distinguish?
Show explanation
It must distinguish current exposure from the intended future controlled state, name the authorized approver, describe interim measures and specify what happens if delivery or verification fails.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.