Risk Management

Recovery Time Objective (RTO)

Max allotted downtime before severe business impact

Recovery Point Objective (RPO)

Max acceptable amount of data loss measured in time

Risk register

List of key risk indicators, risk owners, and risk thresholds

Risk tolerance/risk acceptance

An organization’s willingness to deal with risk to achieve goals (do nothing)

Risk appetite

An organization’s willingness to embrace a level of risk for a given level of output

Exposure Factor (EF)

Percentage of an asset that is lost in an event

Single Loss Expectancy (SLE)

Monetary value to be lost in a single event

• SLE = Asset cost * EF

Annualized Rate of Occurrence (ARO)

Estimated frequency of a threat to occur within a year

Annualized Loss Expectancy (ALE)

Expected annual monetary loss from a risk

• ALE = SLE * ARO

Risk transference

Transfer risk to another party (insurance)

Risk acceptance through exception

Short-term deviation from a specific rule/requirement under specific circumstances

Risk acceptance through exemption

Long-term deviation from a specific rule/requirement

Risk avoidance

Changing plans to eliminate risk entirely

Risk mitigation

Implementing measures to decrease the likelihood or impact of a risk