Events that improve enterprise complexity

Events that contribute to risk reduction

Events contributing to impact or frequency of loss events

Positive impact-generating events

The occurrence of security events

The incidence of operational errors

The acceptance of residual risk

The frequency of audits

Trigger alerts when certain thresholds are met

Provide early warnings of increased risk

Identify underperforming aspects of an enterprise

Provide late warnings of increased risk

After management has implemented a response to new risks

Before any risk response has been applied.

In the current moment despite the application of existing risk responses.

Despite continuous reassessment and modification of risk responses.

The negative impact on enterprise efficiency

The physical and IT nature, with new and outdated technologies posing risks

The classification as intangible assets

The valuation difficulties

Focusing on data exploitation

Avoiding strategic plans

Impeding value

Preserving value

Developing detailed risk scenarios

Assessing the impact of different risk scenarios

Identifying vulnerabilities in the IT infrastructure

Classifying assets according to their importance

Updating internal control systems

Conducting regular risk reporting

Promptly addressing exceptions

Providing independent and objective reviews

Preventive

Detective

Corrective

Compensating

Observing a process

Enterprise architecture assessments

Capability maturity models

Logs and trouble tickets

A. A strategic advantage that protects the system from potential threats

B. A powerful capability that can mitigate enterprise vulnerabilities

C. A weakness in a process that could expose the system to adverse threats

D. A strength in a process that could expose the system to adverse threats

The ability to observe and recognize anything wrong

The focus on worst-case events and less severe incidents

The involvement of all parties in the risk scenario process

The enterprise complexity and exposure

Compliance indicators

Lagging indicators

Process indicators

Leading indicators

Certainties and expected results

Adverse impact and deviations from expected results

Control and certainty

Consistency and control conditions

A comparison of KPIs and KRIs

A predictive insight into potential risk events

An assessment of control monitoring activities

A retrospective view of risk events

Thresholds for control performance

Staff training

Installation procedures

Change management

A. Frequency and impact assessment

B. Scenario generation

C. Systemic and contagious risks

D. Visibility and recognition

Are used to provide a high-level overview and measure of past performance.

Are qualitative and thus hard to measure over time.

Predict future statuses of controls

Adjusting existing controls

To create misunderstandings between IT and management

To document factors impacting the risk assessment

To confuse senior management

To simplify the risk assessment process

Project management and compliance requirements

Human resources (HR) policies and fraud risk policy

Quality management and service policies

Business impact analysis, contingency plans, and recovery requirements

To ensure that resources committed are used ineffectively

To ensure that there is no confidence in surviving a disruption

To ensure that no plan components need coordination

To ensure proper coordination among various plan components and effective resource utilization

CEO

Executive committee

CFO

COO

To understand factors outside their control

To develop detection and containment capabilities

To focus on user awareness training

To ensure control over incidents

By measuring the impact of IT-related problems on business services

By combining all the components of risk, including threats, vulnerabilities, and impact

By considering the likelihood of attack success

By recognizing the threats and characteristics of a threat source

Estimating the frequency and magnitude of risk scenarios

Developing scenarios to describe potential risk events and estimate their impact

Determining how often a particular risk scenario might occur during a specified period

Comparing estimated risks against given risk criteria

To eliminate or minimize risk at all costs

To align risk with management's acceptable level of risk based on the risk analysis

To create an exception process for managing risk

To provide guidelines for risk assessment and management

Avoid documenting assumptions to reduce complexity

Document conflicting assumptions

Document assumptions clearly

Document vague assumptions

Implementing new controls

Creating vulnerability assessments

Documenting risk scenarios

Assessing the current state of controls

Forward-looking metric providing an early warning that risk may soon be realized before an event occurs

Backward-looking metric indicating risk has been realized after an event has occurred

In place to prevent events from occurring

Measures upper and lower limits to help an enterprise understand when a condition requires attention before the risk is realized

Creating complex incident response plans

Awareness education and training

Hiring external consultants

Implementing new controls

To anticipate and mitigate risks

To only react to risks

To identify risks after they occur

To ignore risks and react when they occur

To aggregate risk primarily at a departmental level

To obtain a comprehensive view of overall risk

To obscure actionable details while aggregating

To focus on easily measurable but less relevant risk

A. Historical context, feedback on risk appetite, early warning signals

B. Detailed projections and ad-hoc feedback on risks

C. Late warning signals and lack of historical context

D. Inaccurate data collection and undefined measurement objectives

Patching all critical patches within 30 days

The development of effective risk management practices

The risk of unpatched systems leading to data breaches

Continuous monitoring process in the enterprise

A. Digital initiatives

B. Data management

C. IT governance

D. Risk management

A. Roles and responsibilities

B. Risk data collection

C. Risk culture

D. Risk governance

To assess the detectability of risk scenarios

To develop a generic risk structure for reporting

To gain organizational buy-in for risk scenarios

To identify risks and put in place countermeasures

Every threat is associated with a threat actor.

Threat actors are limited to humans.

Threat actors encompass competitors as well.

Threat actors encompass a variety of potential sources beyond just humans.

I&T- and non-I&T-related events

Assets, systems, or applications important to the enterprise

Mission strategy and business objectives

Understanding business goals and impact criteria

Controls can only be categorized as technical in a control matrix

Controls are essential for risk mitigation and include both proactive and reactive measures

Controls prevent, detect, and correct damage resulting from an incident but do not enable recovery

Controls are not essential for risk mitigation

To transfer or share risk with another enterprise

To understand liability, compliance, due care, due diligence, and create a risk management culture

To reduce the impact of risk

To avoid risk altogether

By aligning with enterprise risk management when possible

By impeding the business or mission objectives

By avoiding any alignment with enterprise risk management

By promoting ethical and open communication

Confidentiality, integrity, and availability

Destruction, disclosure, and loss

Unauthorized access, improper modification, and destruction

Disclosure, modification, and non-accessibility

Any person, thing, or entity that acts or carries out a threat

Only external entities that act maliciously

Only nature and external requirements

Only internal entities that act accidentally

To track and manage identified risks

To communicate risk assessment results to senior management

To identify and analyze risks

To create a comprehensive risk assessment report

The effectiveness of IT operations

The business objectives and risks

The current state of controls

The performance of external entities

Early warning signals, historical context, and feedback on risk appetite

Immediate response signals, ad-hoc data collection, and lack of logical relationship with specific risks

Late feedback signals, real-time data collection, and undefined measurement objectives

Delayed response signals, future projections, and historical context

To guarantee impartiality and consistency throughout the enterprise

To detect critical risk scenarios at a high level

To understand how adverse events may affect business or mission objectives

To identify potential high-risk areas

Potential consequences of a given risk scenario

Culture, resources, skills, environment, and risk appetite

Frequency and magnitude of a given risk scenario

Criticality and sensitivity of IT assets

Financial constraints limit analysis resources

A cost-benefit analysis is necessary.

Quantifying reputation and employee morale is the aim.

Regulatory compliance requires numerical assessments.

To indicate very low risk offering opportunities to save costs

To identify trends or common profiles for more efficient risk response activities

To express evaluated risk using well-defined and unambiguous impact criteria

To compare different risk assessment methods over time

Raise concerns and report suspicious activity

Adhere to quality improvement initiatives

Participate in risk scoping activities

Engage in ethical communication

The dependencies of other systems on the affected IT system

The level of risk associated with a threat

Results that can be compared over time

As much significant risks as possible

Annual Loss Expectancy (ALE)

Single Loss Expectancy (SLE)

Value at Risk (VaR)

Earnings at Risk (EaR)

A. Evaluation of risk appetite, risk tolerance, and risk capacity

B. Determination of resource optimization

C. Promotion of ethical communication

D. Consistency in risk assessment methods

Events that contribute to reducing impact frequency

Positive impact-generating events within the enterprise

Circumstances or events brought about by a threat actor that can trigger loss events

Circumstances or events brought about by nature or external requirements

Monitoring and predicting the state of risk management

Defines the boundaries within which risk management activities operate

Behavioral guidelines in protecting corporate information and associated systems

Sets guidelines on how to act in crisis situations and details the sequence for dealing with risk areas

Enhanced risk response

Improved strategic planning

False sense of confidence

Increased stakeholder communication

Obscure actionable details while aggregating

Aggregate risk in a single dimension only

Aggregate like data consistently and meaningfully

Aggregate risk primarily at the departmental level

To identify vulnerabilities proactively

To monitor controls

To conduct self-assessment

To implement new controls

To determine the business impact of a breach or loss of an asset

To analyze financial assets and their potential risks

To facilitate communication and understanding of potential risks

To conduct interviews with potential pitfalls

To set risk appetites, provide meaning to risk, and reflect areas relevant to business objectives

To create false assurance and inconsistency

To estimate the frequency and magnitude of a given risk scenario

To identify risks on a system-by-system basis

The relationship between risk and control is indirect

Controls have no impact on managing and mitigating risk

There is a direct relationship

There is no relationship between risk and control

Risk detection and response

Resource alignment

Regulatory compliance

Decision-making

By avoiding any preparation for changes in the industry at large

By ignoring changes in laws and regulations

By minimizing assessment of key processes and associated risks

By giving advance consideration to changes in the enterprise and applicable laws and regulations

Complex discussions on risk and unchanged risk awareness

Limited communication on risk and decreased business objectives alignment

Clear and measurable discussions on risk and improved risk awareness

Vague discussions on risk and decreased risk awareness

To establish the origins of events and prevent problem recurrence

To ignore events and their consequences

To identify risks before they occur

To analyze completed projects

Conducting formal inspections and verifications

Offering independent testing and assurance

Monitoring controls

Managing risk

Control types

Threats

Vulnerabilities

Risk states

To assess the financial value of assets

To understand the business impact of a breach or loss of an asset

To evaluate the impact of assets on business reputation

To identify potential threats and vulnerabilities

Key Performance Indicator

Key Promise Indicator

Key People Indicator

Key Privacy Indicator

Single Loss Expectancy (SLE)

Value at Risk (VaR)

Annual Loss Expectancy (ALE)

Earnings at Risk (EaR)

By treating I&T-related risk as a separate type of risk

By ignoring business or mission objectives

By clearly defining risk appetite and risk tolerance

By limiting the consequences of I&T-related risk

To provide reports that are systematic and timely

To collect and validate business, IT, and process goals and metrics

To prevent acceptance of risk that exceeds the risk acceptance criteria set by the business

To monitor processes to ensure they are performed in line with established performance metrics

Setting flexible risk acceptance criteria

Gathering data from various sources in a timely and accurate manner

Creating comprehensive reports on IT performance

Aligning IT-related risk with business risk

Measuring and assessing inherent risk.

Selecting metrics that exceed risk tolerance.

Observing and assessing potential risk events.

Accepting risk cant be avoided

Implementing risk governance controls

Avoiding enterprise dependencies

Focusing on natural disasters

Balancing costs and benefits

Lagging indicators

Process indicators

Compliance indicators

Leading indicators

Resource optimization

Assessor bias mitigation

Dynamic nature of risk

Nature of the business

Assessed level or priority of each risk

Budget allocation for implementing risk responses

General business objectives

Employee feedback on risk identification

Special enterprise structures

The chairperson

The stakeholders

The board of directors

To present risk in a two-dimensional diagram based on frequency and impact

To identify trends or common profiles for more efficient risk response activities

To measure the impact of IT-related problems on business services

To compare risk over time using consistent methods

Determine whether controls are cost efficient

Determine whether controls are functioning as designed.

Verify whether controls are effectively addressing risk.

Determine the type of controls needed to address risk.

Mission strategy and business objectives

Hypothetical situations envisioned by the people performing job functions

Assets, systems, or applications important to the enterprise

Threats or generic loss scenarios

The involvement of all parties in the risk scenario process

The visibility and recognition of anything wrong

The focus on worst-case events and less severe incidents

The development of relevant and manageable risk scenarios

To determine the sensitivity and criticality of IT assets

To evaluate the impact of IT assets on business reputation

To identify potential threats and vulnerabilities

To assess the financial value of IT assets