risk-assessment

name	risk-assessment
description	Run a structured security risk assessment and maintain a risk register — identify, analyze, evaluate, and treat risks (ISO 27005 / NIST SP 800-30) against the organization's risk criteria. Use for an enterprise/security risk assessment, risk register upkeep, or treatment decisions.

Goal

A defensible risk register: the organization's security risks identified, analyzed against consistent criteria, evaluated against risk appetite, and assigned explicit treatment decisions with owners.

Process (ISO 27005 / NIST 800-30)

1. Establish context — scope, assets in scope, the risk criteria (likelihood/ impact scales) and the org's risk appetite/acceptance thresholds.
2. Identify risks — asset × threat × vulnerability scenarios (and the consequence). Draw on threat-modeling, findings, incidents (dfir), and threat intel.
3. Analyze — assign likelihood and impact per the defined scales; derive a risk level. Note existing controls and their effect (inherent vs. residual risk).
4. Evaluate — compare residual risk to the criteria/appetite; decide which risks require treatment and their priority.
5. Treat — choose per risk: mitigate (control + cost), transfer (insurance/contract), avoid (stop the activity), or accept (with owner and documented sign-off). Define the treatment plan.
6. Register & monitor — record in the risk register (ID, description, owner, inherent/residual level, treatment, status, review date); review on a cadence and on change.

Output

A risk register + a risk heat map, with treatment plans and accountable owners. Use security-reporting; visualize the heat map with security-diagramming:infographic. Feeds compliance-assessment (risk-based controls) and the CISO view.

Notes

Use consistent, documented criteria so risks are comparable and the register is defensible. Distinguish inherent vs. residual risk (after controls). This is the operational, register-based view; for financial/board framing of top risks use ciso-toolkit:cyber-risk-quantification. Accepted risk must be explicitly owned and signed off — never defaulted.