Risk concepts, scenarios, assessment and treatment

Describe a risk before trying to score it

Security risk concerns uncertain consequences for objectives, commonly understood through potential impact and likelihood in context. A useful scenario connects an important asset or objective, a threat event, a vulnerability or predisposing condition and a consequence. A threat is a possible cause of harm; a vulnerability is a weakness or condition that can be exploited. Neither is the whole risk. State assumptions so that other people can challenge the reasoning; no universal numeric formula is implied.

Distinguish the assessment activities

Identification describes what might happen and to what. Analysis develops understanding of likelihood, consequences and relevant uncertainty. Evaluation compares the result with criteria to inform priorities and decisions. Risk assessment is broader than analysis. Management also sets context, chooses responses and monitors results. The NIST example uses context, identification, analysis, prioritization, response and monitoring/adjustment; it is illustrative rather than an ISO-mandated sequence.

Choose a method that can support the decision

Qualitative categories can communicate judgments; quantitative estimates use meaningful numerical values and assumptions. Giving “high” the number 3 does not turn it into a measured probability or justify multiplying ordinal labels as if they were ratios. Choose methods using decision needs, resources, available evidence and data reliability. A precise-looking number can still rest on weak assumptions.

Respond, record and revisit

A response can change exposure, avoid an activity, share some consequences or retain risk, depending on the context and authority. Record the scenario, accountable owner, rationale, selected actions, status and review information. Residual risk is what remains after the response. A provider or insurance arrangement does not make all risk disappear. Registers evolve as actions and conditions change; the new state becomes the next cycle’s starting point.

Connect the terminology.