| name | risk-assessment |
| description | Run a structured security risk assessment and maintain a risk register — identify, analyze, evaluate, and treat risks (ISO 27005 / NIST SP 800-30) against the organization's risk criteria. Use for an enterprise/security risk assessment, risk register upkeep, or treatment decisions. |
Goal
A defensible risk register: the organization's security risks identified, analyzed
against consistent criteria, evaluated against risk appetite, and assigned explicit
treatment decisions with owners.
Process (ISO 27005 / NIST 800-30)
- Establish context — scope, assets in scope, the risk criteria (likelihood/
impact scales) and the org's risk appetite/acceptance thresholds.
- Identify risks — asset × threat × vulnerability scenarios (and the consequence).
Draw on
threat-modeling, findings, incidents (dfir), and threat intel.
- Analyze — assign likelihood and impact per the defined scales; derive a risk
level. Note existing controls and their effect (inherent vs. residual risk).
- Evaluate — compare residual risk to the criteria/appetite; decide which risks
require treatment and their priority.
- Treat — choose per risk: mitigate (control + cost), transfer
(insurance/contract), avoid (stop the activity), or accept (with owner and
documented sign-off). Define the treatment plan.
- Register & monitor — record in the risk register (ID, description, owner,
inherent/residual level, treatment, status, review date); review on a cadence and
on change.
Output
A risk register + a risk heat map, with treatment plans and accountable owners. Use
security-reporting; visualize the heat map with security-diagramming:infographic.
Feeds compliance-assessment (risk-based controls) and the CISO view.
Notes
Use consistent, documented criteria so risks are comparable and the register is
defensible. Distinguish inherent vs. residual risk (after controls). This is the
operational, register-based view; for financial/board framing of top risks use
ciso-toolkit:cyber-risk-quantification. Accepted risk must be explicitly owned and
signed off — never defaulted.
