5.1 Risk Management

Risk Identification

A core part of organizational security, helping to detect and address potential problems.

• As organizations grow, so do their risks—both internal and external.

• Helps pinpoint these threats and assess their impact, ensuring that proper controls are in place to manage or mitigate them.

Performing a Risk Assessment

Can vary based on an organization’s needs and concerns.

• Some organizations conduct one-time risk assessments, often tied to specific projects such as acquisitions or the introduction of new technology, to identify potential risks associated with those events.

• Others treat risk assessment as an ongoing process, regularly evaluating risks—especially during change management—to ensure each change is analyzed for potential impact before implementation.

Ad Hoc Assessments

Performed for a specific, immediate purpose.

• For example, if a CEO learns about a new attack targeting similar companies, they may request a focused assessment to determine if their organization is vulnerable to that particular threat.

• Typically, a committee is formed to analyze this specific risk, produce a report, and present findings to leadership.

• After the assessment and presentation, the committee is disbanded.

• Because the scope is narrow and specific, this type of assessment usually doesn’t need to be repeated.

Recurring Assessments

Conduct risk assessments on a regular, scheduled basis—such as quarterly, semi-annually, or annually.

• Are often done internally by an organization’s own team, who maintain ongoing documentation of risks and updates.

• Are mandated by regulations or industry standards.

• For example, organizations that store credit card data must perform annual risk assessments to comply with the Payment Card Industry Data Security Standard (PCI DSS).