Risk Management and Security Frameworks

Introduction

Cybersecurity is not simply the installation of antivirus software, firewalls, or access-control systems. It is the disciplined management of uncertainty affecting information, systems, people, and organizational operations. Every organization has limited money, time, staff, and technical capacity. Risk management helps decision-makers determine which security problems deserve attention first, what safeguards are appropriate, and how much residual risk can be accepted.

A security framework provides a structured way to organize this work. Frameworks do not eliminate risk, and they are not interchangeable checklists. Instead, they provide common language, processes, categories, and practices for governing and improving cybersecurity.

This chapter introduces asset identification, threats, vulnerabilities, likelihood, impact, and risk. It then explains basic qualitative risk assessment and compares four important frameworks: the NIST Cybersecurity Framework (CSF), NIST Risk Management Framework (RMF), ISO/IEC 27001, and the CIS Critical Security Controls. It also considers compliance obligations, treatment decisions, governance, ethics, and practical implementation.

Learning Objectives

By the end of this chapter, you should be able to:

1. Identify organizational assets, threats, vulnerabilities, existing controls, and risk owners.
2. Explain how likelihood, impact, and uncertainty contribute to risk.
3. Perform a basic qualitative risk assessment using a risk matrix.
4. Select and justify risk treatment options.
5. Distinguish the purposes of NIST CSF, NIST RMF, ISO/IEC 27001, and CIS Controls.
6. Relate security risk management to legal, regulatory, contractual, and ethical responsibilities.
7. Communicate risk findings clearly to technical and non-technical decision-makers.

1. The Foundations of Cybersecurity Risk

Assets

An asset is anything valuable that an organization needs to protect. Assets include more than computers and networks. Examples are:

• Customer records, intellectual property, credentials, and financial data.
• Applications, databases, cloud services, endpoints, and network devices.
• Business processes such as payment processing or emergency response.
• Facilities, employees, suppliers, reputation, and legal standing.

Asset value depends on the consequences of loss, alteration, disclosure, or unavailability. A public website may have low confidentiality requirements but high availability requirements. A payroll database may require high confidentiality, integrity, and availability.

The confidentiality, integrity, and availability (CIA) triad provides a basic method for describing security objectives:

• Confidentiality: information is accessible only to authorized parties.
• Integrity: information and systems remain accurate, complete, and trustworthy.
• Availability: authorized users can access systems and information when required.

Asset inventories should identify an owner, business purpose, location, dependencies, data classification, and recovery requirements. An inventory that lists devices but omits cloud services, suppliers, and critical processes is incomplete.

Threats

A threat is a potential cause of an unwanted incident. Threat sources may be external attackers, malicious insiders, careless employees, criminal groups, competitors, natural events, or technology failures. Examples include phishing, ransomware, credential theft, power failure, fire, software defects, and supplier compromise.

A threat is not itself a loss. A threat becomes relevant when it can affect a particular asset through a plausible pathway. For example, ransomware is a threat; an unpatched internet-facing server may provide a pathway to a business-critical database.

Vulnerabilities

A vulnerability is a weakness that can be exploited or triggered. Vulnerabilities may be technical, administrative, physical, or human. Examples include unsupported software, excessive privileges, weak authentication, missing backups, unclear procedures, and inadequate physical access controls.

A vulnerability does not automatically create a serious risk. Its significance depends on exposure, threat capability, existing controls, asset value, and the organization’s ability to detect and recover from an incident.

Controls

A control is a measure that modifies risk. Controls can be:

• Preventive: reduce the chance of an incident, such as multifactor authentication.
• Detective: identify events, such as centralized logging and monitoring.
• Corrective: restore or repair, such as malware removal and system recovery.
• Administrative: policies, training, risk ownership, and procedures.
• Technical: encryption, access control, segmentation, and secure configuration.
• Physical: locks, guards, environmental controls, and visitor management.

Controls may reduce likelihood, impact, or both. Backups may not prevent ransomware, but they can substantially reduce its business impact.

Risk and Risk Owners

Risk is the effect of uncertainty on objectives. In cybersecurity practice, risk commonly describes the possibility that a threat will exploit a vulnerability and cause harm to an asset or business objective. A risk statement should identify:

Threat may exploit vulnerability affecting asset, causing consequence.

For example: “A criminal group may exploit weak remote-access authentication, causing unauthorized access to the customer-support system and disclosure of personal data.”

A risk owner is the person accountable for ensuring that a risk is assessed and treated. The risk owner is not necessarily the person who performs the technical work. A business executive may own the risk while infrastructure staff implement controls.

2. Likelihood, Impact, and Risk Evaluation

Likelihood

Likelihood expresses how probable or plausible an event is within a defined period. It may be informed by threat intelligence, exposure, historical incidents, exploit availability, control effectiveness, and attacker motivation. Qualitative terms such as low, medium, and high are useful only when the organization defines them consistently.

For example, an organization might define high likelihood as an event expected or very plausible within one year, medium as plausible but dependent on conditions, and low as unlikely under current circumstances. The exact definitions should be documented rather than assumed.

Impact

Impact describes the magnitude of harm if an event occurs. Impact may include:

• Financial loss and recovery costs.
• Loss of confidentiality, integrity, or availability.
• Injury or danger to people.
• Legal, regulatory, or contractual consequences.
• Operational disruption.
• Reputational damage and loss of trust.

Impact should be evaluated against organizational objectives. A one-hour outage may be tolerable for an internal information portal but unacceptable for a hospital emergency service.

Basic Risk Models

A simple conceptual model is:

Likelihood and impact are usually ordinal ratings rather than precise measurements. If both are rated from 1 to 5, a score can be calculated as:

where R is the risk score, L is the likelihood rating, and I is the impact rating. This is a prioritization aid, not a physical law or an exact probability calculation. It is valid only when rating definitions are consistent and the organization understands that ordinal scores do not necessarily have equal intervals.

A risk matrix may classify scores of 1–4 as low, 5–9 as moderate, 10–16 as high, and 17–25 as critical. These thresholds are examples and must be approved by the organization.

Worked example. An exposed remote-access service has a likelihood rating of 4 and an impact rating of 5. Its score is R = 4 × 5 = 20, which falls in the example critical category. The result does not prove that an incident will occur; it indicates that the scenario should receive urgent attention under the organization’s chosen criteria.

Quantitative models can use monetary estimates, but they require reliable data. A commonly used model is:

where ALE is annualized loss expectancy, SLE is single-loss expectancy, and ARO is annual rate of occurrence. SLE is the estimated loss from one event, and ARO is the expected number of events per year. This model assumes that monetary estimates and event-frequency estimates are meaningful and comparable. It should not create false precision when evidence is weak.

Inherent and Residual Risk

Inherent risk is the risk before considering additional controls, although existing conditions may be included depending on the organization’s method. Residual risk is the risk remaining after controls are applied. A control may reduce risk without eliminating it. For example, multifactor authentication reduces the chance of account takeover but does not prevent all phishing, session theft, or insider misuse.

Risk appetite is the general amount and type of risk an organization is willing to pursue or retain. Risk tolerance defines acceptable variation around objectives. These concepts help determine when escalation or treatment is required.

3. Conducting a Basic Qualitative Risk Assessment

A practical assessment follows a repeatable sequence:

1. Define scope and criteria. Identify the business unit, systems, time period, risk scale, and impact categories.
2. Identify assets and owners. Record information, services, dependencies, and responsible managers.
3. Identify threat scenarios. Describe realistic events rather than listing vague threats.
4. Identify vulnerabilities and existing controls. Consider technical, human, physical, and supplier weaknesses.
5. Estimate likelihood. Use evidence and documented rating criteria.
6. Estimate impact. Consider operational, financial, legal, safety, and reputational effects.
7. Determine and prioritize risk. Apply the approved matrix or evaluation method.
8. Select treatment. Assign an owner, action, deadline, and acceptance authority.
9. Record assumptions and uncertainty. State what is unknown and how it affects the result.
10. Review and monitor. Reassess after significant changes, incidents, new vulnerabilities, or changes in business activity.

A useful risk register contains the following fields:

Assessment quality depends on evidence. Useful evidence includes asset inventories, vulnerability scans, audit findings, incident records, penetration-test results, business-impact analyses, supplier assessments, and interviews. A scan alone cannot determine business impact.

4. Risk Treatment Options

Organizations generally use four treatment options:

• Avoid: stop the activity that creates unacceptable risk. For example, discontinue an unsupported service.
• Reduce or mitigate: implement controls that lower likelihood or impact. Examples include patching, segmentation, backups, training, and encryption.
• Share or transfer: distribute financial or operational consequences through insurance, contractual arrangements, or an outsourced service. Accountability cannot be completely transferred; the organization may remain responsible for protecting data and meeting legal duties.
• Accept: retain the risk knowingly within approved tolerance. Acceptance should be explicit, time-bounded where appropriate, and approved by an authorized risk owner.

A further practical option is to defer, but deferral should not become informal acceptance. A deferred action needs a reason, owner, deadline, interim safeguards, and escalation path.

Treatment selection should consider effectiveness, cost, feasibility, usability, dependencies, and possible new risks. A control that blocks legitimate work may lead users to bypass it. Security decisions should therefore be proportionate and risk-based.

5. Major Security Frameworks

NIST Cybersecurity Framework 2.0

The NIST Cybersecurity Framework (CSF) is a flexible framework for managing cybersecurity risk across organizations of different sizes and sectors. CSF 2.0 is organized around six concurrent and continuous Functions:

The CSF Core contains Functions, Categories, and Subcategories. Organizations may create a Current Profile describing present practices and a Target Profile describing desired outcomes. The gap between the profiles supports a prioritized improvement plan. The CSF is outcome-oriented and does not prescribe one technology or implementation method.

NIST Risk Management Framework

The NIST RMF provides a structured lifecycle for managing security and privacy risk in systems. Its seven steps are:

1. Prepare: establish organization- and system-level context, priorities, and risk information.
2. Categorize: determine the potential adverse impact of losing confidentiality, integrity, or availability.
3. Select: choose controls based on risk and applicable baselines.
4. Implement: deploy controls and document implementation.
5. Assess: determine whether controls are correctly implemented and effective.
6. Authorize: an authorizing official accepts or rejects operation based on risk.
7. Monitor: continuously monitor controls, changes, threats, and risk.

The RMF is particularly prominent in U.S. federal information systems, but its lifecycle logic is useful more broadly. It emphasizes authorization accountability, control assessment, continuous monitoring, and integration of privacy and supply-chain considerations.

ISO/IEC 27001

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). An ISMS is a management system, not merely a collection of technical controls. It connects organizational context, leadership, planning, support, operation, performance evaluation, and improvement with information-security risk management.

Organizations define the ISMS scope, establish criteria, assess and treat risks, document applicable controls, monitor performance, and conduct internal reviews. ISO/IEC 27001 certification involves independent conformity assessment against the standard’s requirements. Certification does not guarantee that no breach will occur.

The 2022 edition’s Annex A contains 93 reference controls organized into four themes: organizational, people, physical, and technological. An organization does not automatically need every control; it justifies applicability and exclusions through its risk treatment and Statement of Applicability. The requirements of the ISMS and the selection of controls must not be confused.

CIS Critical Security Controls

The CIS Critical Security Controls are prioritized safeguards intended to help organizations defend against common attacks. CIS Controls v8.1 contains 18 Controls, supported by implementation groups. Implementation Group 1 provides a starting set for organizations with limited resources; higher groups add safeguards for organizations with greater risk and capability.

Examples include asset inventories, software inventories, data protection, secure configuration, account management, access control, vulnerability management, audit-log management, email and browser protections, malware defenses, data recovery, network monitoring, and security awareness.

CIS Controls are highly actionable and useful for operational improvement. Unlike ISO/IEC 27001, they are not primarily a certification-based management-system standard. Unlike the CSF, they are more prescriptive safeguards. They can be mapped to other frameworks.

Comparing the Frameworks

Frameworks can be combined. For example, an organization may use CSF Functions to communicate its program, ISO/IEC 27001 to operate its ISMS, RMF-style control assessment for high-impact systems, and CIS Controls to prioritize technical implementation.

6. Compliance, Governance, and Ethics

Compliance is not identical to security. A regulation, law, contract, or sector requirement may specify duties concerning privacy, breach notification, payment data, health information, financial records, critical infrastructure, or public-sector systems. Requirements vary by jurisdiction and change over time. Organizations must identify applicable obligations with qualified legal and compliance professionals.

A compliance checklist can reveal gaps, but compliance alone does not prove that risk is acceptable. Conversely, a control may reduce risk even when it is not explicitly required by a regulation. Evidence should demonstrate not only that a policy exists, but that controls operate effectively.

Important governance practices include:

• Assigning accountable risk owners and approval authorities.
• Separating security assessment from unauthorized self-approval where practical.
• Maintaining accurate evidence and audit trails.
• Reporting material incidents promptly and truthfully.
• Protecting personal data through purpose limitation, minimization, access control, retention, and secure disposal.
• Including security and notification duties in supplier contracts.
• Avoiding deceptive claims such as “completely secure.”

Ethical risk management respects employees, customers, and affected communities. Monitoring should be necessary, proportionate, transparent where possible, and limited to legitimate purposes. Vulnerability testing must be authorized. Security professionals should protect sensitive assessment results because risk registers, exploit details, and system diagrams can themselves become targets.

7. Applied Case: Riverside Community Clinic

This is an illustrative case, not a report of a real organization.

Background

Riverside Community Clinic operates a patient-record system, online appointment portal, medical devices, email, and a cloud payroll service. It has 120 employees and a small IT team. Remote access was introduced rapidly during a period of expanded community services.

Problem

An assessment found that several staff members used password-only remote access. Some laptops had not received recent security updates, backups had not been tested for six months, and a supplier managed part of the appointment portal. Management initially requested a list of technical weaknesses, but the security lead reframed the work around business risks.

Analysis

The team identified the patient-record system as a high-value asset because disclosure could harm patients and create legal and regulatory consequences, while unavailability could disrupt clinical care. The principal scenario was: “An attacker may obtain remote-access credentials through phishing and use them to access patient records or deploy ransomware.”

Existing controls included endpoint protection, staff training, daily cloud replication, and basic logging. Weaknesses included password-only access, inconsistent patching, limited monitoring, and untested restoration. The team rated likelihood as 4 and impact as 5 using the clinic’s approved five-point scale, giving a score of 20, classified as critical under its example matrix.

Approach and Solution

The clinic selected the following treatments:

1. Enable multifactor authentication for remote access and privileged accounts.
2. Establish a risk-based patching process with defined deadlines for critical vulnerabilities.
3. Segment clinical systems from ordinary office devices.
4. Test backup restoration and maintain a protected recovery copy.
5. Improve centralized logging and define escalation procedures.
6. Reassess the appointment-portal supplier and add security and incident-notification clauses.
7. Use the CSF to create a Current Profile and Target Profile.
8. Use CIS Controls to prioritize asset inventory, secure configuration, account management, vulnerability management, logging, and recovery.
9. Record treatment decisions in the risk register and report residual risk to the clinic director.

The clinic accepted a small residual risk associated with legacy medical devices because replacement required a longer procurement cycle. Compensating controls included network isolation, restricted administration, and enhanced monitoring.

Outcome and Learning Points

The case demonstrates that risk management connects technical weaknesses to patient safety, continuity of care, privacy, and accountability. It also shows why frameworks are complementary. The CSF helped communicate program outcomes, CIS Controls guided immediate safeguards, and risk-register governance documented ownership and acceptance.

8. Limitations and Contemporary Developments

Risk ratings can be subjective. Different assessors may assign different scores, and a numerical matrix can hide uncertainty or encourage false precision. Threat environments change rapidly, while a risk register may become outdated. Dependencies between risks can also be missed: a single identity-provider failure may affect many services at once.

Organizations should therefore combine structured scoring with expert judgment, evidence, scenario analysis, and regular review. High-impact safety or privacy risks may require escalation even when likelihood is uncertain.

Cloud computing and software-as-a-service environments complicate ownership. The provider may operate infrastructure, but the customer remains responsible for configuration, identities, data governance, and many compliance duties under the shared-responsibility model. Artificial intelligence introduces additional concerns, including sensitive-data disclosure, inaccurate outputs, prompt injection, model supply-chain risk, excessive automation, and unclear accountability. AI systems should be assessed as assets, services, and threat surfaces rather than treated as automatically secure.

Contemporary best practice includes continuous asset discovery, identity-centered security, secure-by-design development, software supply-chain assurance, tested recovery, vulnerability disclosure processes, and continuous control monitoring. These practices support resilience but do not replace governance or informed risk acceptance.

Best-Practice Checklist

A certificate-level practitioner should be able to confirm that an organization:

• Knows what assets and services it operates and who owns them.
• Links threats and vulnerabilities to realistic business scenarios.
• Uses defined likelihood and impact criteria.
• Records assumptions, evidence, and uncertainty.
• Assigns treatment actions, owners, and deadlines.
• Distinguishes accepted residual risk from untreated risk.
• Selects frameworks according to purpose rather than fashion.
• Tests controls and recovery arrangements, not just policy documents.
• Reviews supplier, privacy, legal, and regulatory obligations.
• Reassesses risk after significant changes and incidents.

Chapter Summary

Cybersecurity risk management is the organized process of identifying what matters, understanding how it may be harmed, estimating likelihood and impact, selecting proportionate safeguards, and monitoring residual risk. Assets include data, systems, people, processes, suppliers, and reputation. Threats are potential causes of harm, vulnerabilities are weaknesses, and controls modify risk.

A qualitative assessment commonly uses defined likelihood and impact scales. The expression risk ≈ likelihood × impact is a prioritization model, not an exact law. A sound assessment requires scope, evidence, documented assumptions, accountable owners, and review. Treatment options are avoidance, reduction, sharing or transfer, and acceptance.

NIST CSF 2.0 organizes outcomes through Govern, Identify, Protect, Detect, Respond, and Recover. NIST RMF provides a lifecycle of Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. ISO/IEC 27001 establishes an auditable ISMS, while CIS Controls provide prioritized operational safeguards. These approaches can be integrated.

Compliance supports accountability but does not guarantee security. Ethical practice requires authorized testing, proportionate monitoring, privacy protection, honest reporting, and responsible treatment of residual risk. Effective cybersecurity is therefore both a technical and a governance discipline.

Key Terms

Asset: Anything of value that an organization needs to protect.

Availability: The property that authorized users can access systems and information when needed.

Control: A safeguard that modifies likelihood, impact, or both.

Confidentiality: Protection against unauthorized disclosure.

CIS Controls: Prioritized safeguards for defending against common cyberattacks.

Impact: The magnitude of harm resulting from a risk event.

Inherent risk: Risk considered before additional treatment is applied.

Integrity: Protection of information and systems against unauthorized or improper alteration.

ISO/IEC 27001: An international standard specifying requirements for an information-security management system.

Likelihood: An assessment of how probable or plausible an event is.

NIST CSF: A framework for organizing cybersecurity outcomes and risk-management activities.

NIST RMF: A lifecycle for system security and privacy risk management, control assessment, authorization, and monitoring.

Residual risk: Risk remaining after controls are applied.

Risk: The effect of uncertainty on objectives.

Risk appetite: The amount and type of risk an organization is generally willing to pursue or retain.

Risk owner: The person accountable for managing a particular risk.

Risk register: A documented record of risks, ratings, owners, treatments, and status.

Threat: A potential cause of an unwanted incident.

Vulnerability: A weakness that can be exploited or triggered.

Review Questions

Short Answer Questions

1. What is the difference between a threat and a vulnerability?
2. Explain the three elements of the CIA triad.
3. What is residual risk?
4. Name the six Functions of NIST CSF 2.0.
5. Why is compliance not identical to security?

Long Answer Questions

1. Explain the steps in a basic qualitative cybersecurity risk assessment.
2. Compare NIST CSF 2.0, NIST RMF, ISO/IEC 27001, and CIS Controls.
3. Discuss the advantages and limitations of using a likelihood-impact risk matrix.
4. Explain the four principal risk treatment options and provide an example of each.
5. Describe how governance and ethical responsibilities influence cybersecurity risk management.

Analytical / Application Questions

1. A university’s learning-management system has weak administrator authentication. Identify the asset, threat, vulnerability, likely impact, and two appropriate treatments.
2. An organization rates a phishing scenario with likelihood 3 and impact 4 on a five-point scale. Using R = L × I, calculate the score and explain why the result should not be treated as an exact probability.
3. A small business has limited resources and no formal security program. Recommend how it could combine the NIST CSF and CIS Controls during its first year, including priorities and ownership.

Multiple Choice Questions with Answers

Question 1

Which statement best describes a vulnerability?

A. A potential cause of an unwanted incident

B. A weakness that can be exploited or triggered

C. The magnitude of harm from an incident

D. A person accountable for accepting risk

Correct Answer: B. A weakness that can be exploited or triggered

Question 2

Which NIST CSF 2.0 Function focuses on strategy, policies, roles, and oversight?

A. Govern

B. Protect

C. Detect

D. Recover

Correct Answer: A. Govern

Question 3

Which sequence correctly represents the NIST RMF lifecycle steps?

A. Identify, Protect, Detect, Respond, Recover

B. Plan, Do, Check, Act, Authorize

C. Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor

D. Discover, Scan, Patch, Encrypt, Report

Correct Answer: C. Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor

Question 4

An organization rates likelihood as 4 and impact as 5. Using R = L × I, what is the risk score?

A. 9

B. 20

C. 25

D. 45

Correct Answer: B. 20

Question 5

Which framework primarily specifies requirements for an auditable information-security management system?

A. CIS Controls

B. NIST CSF

C. ISO/IEC 27001

D. NIST RMF

Correct Answer: C. ISO/IEC 27001

Question 6

Which action is an example of risk avoidance?

A. Encrypting stored data

B. Buying cyber-insurance

C. Accepting the risk with executive approval

D. Discontinuing an unsupported internet-facing service

Correct Answer: D. Discontinuing an unsupported internet-facing service

Question 7

What is the main purpose of a Current Profile and Target Profile in the NIST CSF?

A. To calculate exact annual financial loss

B. To compare present and desired cybersecurity outcomes

C. To replace all vulnerability scanning

D. To certify compliance automatically

Correct Answer: B. To compare present and desired cybersecurity outcomes

Question 8

Which statement about risk transfer is correct?

A. It eliminates the organization’s accountability

B. It distributes some financial or operational consequences but may not remove responsibility

C. It always reduces likelihood to zero

D. It means ignoring the risk until an incident occurs

Correct Answer: B. It distributes some financial or operational consequences but may not remove responsibility

Question 9

Which control is primarily detective?

A. Centralized security logging and monitoring

B. Multifactor authentication

C. A written password policy

D. A physical door lock

Correct Answer: A. Centralized security logging and monitoring

Question 10

What is a major limitation of a simple likelihood-impact matrix?

A. It cannot prioritize risks at all

B. It guarantees that assessments are objective

C. Ordinal scores may create false precision and depend on consistent rating definitions

D. It can only be used for physical security

Correct Answer: C. Ordinal scores may create false precision and depend on consistent rating definitions