Information Security Risk
Information security risk management is the ISO 27001 half of the risk family. It answers: what could happen to our information, how bad would it be, and what are we doing about it?
A risk record pairs a threat with a vulnerability — something that could act, and the weakness it would act through — against something at stake, and scores the consequence on the three security attributes: confidentiality, integrity and availability.
Where asset risk asks what an asset is worth, this module asks what could happen to it. The two are separate assessments and separate registers, and this one can read the other's answer as an input.
What makes this module different from its siblings
| Here | The other risk modules | |
|---|---|---|
| Impact | Three dimensions — confidentiality, integrity, availability | One severity |
| Formula tiers | Three: impact score → risk score → band | Two: score → band |
| Control catalogue | ISO 27001 Annex A, 93 controls, numbered by the standard | Your own lists |
| Extra artefact | The Statement of Applicability | — |
| Treatment | An explicit risk treatment option that drives the flow | Implicit |
The building blocks
| Concept | Purpose |
|---|---|
| Risk main form | The register, with its code template, authorization matrix and assessment approach. See Main Forms. |
| Risk | The record: the threat, the vulnerability, what is at stake, two scoring passes, the treatment. |
| Threat / vulnerability / Annex A control | The three catalogues a record is assembled from. See Threats, Vulnerabilities, Annex A Controls. |
| Risk treatment option | Modify, retain, share or avoid. Drives the flow's first branch. See Treatment Options. |
| Risk measure | The work a risk waits on. See Risk Measures. |
| Statement of Applicability | The document an audit is run against. See Statement of Applicability. |
The record
- Code — issued from the main form's code template.
- Definition — what could happen. This is the record's identity; it is what a reader recognizes it by.
- Risk main form — the register.
- Scope organization unit — where the risk applies.
- Assessment approach — asset-based or event-based. Defaulted from the main form, changeable per record.
- Owners — who is accountable. The first approval raises its task from this.
- Asset link — what is at stake. See below.
- Threat and vulnerability — from the catalogues.
- Existing controls and existing control note — what is already in place.
- Initial scoring — probability plus the three impact dimensions, and the resulting scores and band.
- Risk treatment option — how the risk will be handled.
- Selected controls — the Annex A controls chosen as the treatment, each with its justification.
- Residual scoring — the same set again, after the measures.
- Event description and notes — free text.
- Attachments.
The record's identity is its definition — the sentence describing what could happen. Codes are unique within a main form, not across the module: two registers given the same template both start at 1.
The asset link: one row, three ways
A risk names at most one thing at stake, and there are three ways to name it. Which one you use decides what the link brings with it:
| Link type | Needs | Brings |
|---|---|---|
| Asset risk assessment | Asset Risk module | Identity, type, the C/I/A ratings, the asset value, and the assessment's revision chain |
| Asset group | Asset Risk module | The highest C/I/A and asset value among the group's members, and how many members there were |
| Asset, directly | — | Identity and type. No ratings and no asset value |
The module works without Asset Risk. The third link type points straight at an asset in the registry, and what that costs is the scoring prefill and nothing else — the risk stays asset-based.
Everything but the link itself is a snapshot, read once when the link is made. If the asset's ratings change afterwards, the risk score does not move. That is deliberate: a score that drifted because somebody re-rated an asset would make an approved assessment untraceable.
The form only offers link types it can honour
The server decides which link types are available, and says why one is missing rather than showing a shorter list without explanation:
- The two Asset Risk link types need that module installed.
- If the risk score formula names the asset value, the direct asset link is withdrawn and so is the option of linking nothing — an asset in the registry has no asset value to feed the formula.
Asset-based and event-based risks
The assessment approach decides whether the record must name something at stake:
- Asset-based — the risk is assessed against an asset. The main form normally requires the link.
- Event-based — the risk is a scenario with no particular asset behind it. The asset link may be left empty.
The main form sets the default; a record may change it. A main form cannot, however, require an asset link while defaulting to event-based — the two settings would contradict each other, so the requirement is dropped rather than enforced against the approach.
Use event-based for risks that are genuinely organizational — a supplier failing, a regulation changing, a process that has no owner. Forcing those onto an asset produces a register where half the entries name an asset nobody believes is really the subject.
Existing controls versus selected controls
Two separate collections of Annex A controls, and the difference matters:
- Existing controls — what is already in place. Read as part of the initial assessment: the risk is scored as it stands today, with these controls working.
- Selected controls — what is chosen as the treatment, at the control step, each with a justification.
Only selected controls feed the Statement of Applicability's suggestion. A control already in place is not evidence that the standard's clause applies to this scope — it may be there for another reason entirely.
Two scoring passes
The record carries two complete scorings: initial, as the risk stands today, and residual, after the treatment. Each is a probability plus three impact ratings, resolved through three formula tiers. See Scoring.
On the measure-free routes the residual pass is copied from the initial one rather than left empty. The residual risk of an accepted risk is its current risk, and leaving it blank would show those risks unscored in the reports and in the Statement of Applicability.
Creating a risk
- Open Information Security Risk Management → Risks and pick the main form.
- Choose New. The code field shows the register's template.
- Write the definition — what could happen.
- Set the scope organization unit and the owners.
- Choose the assessment approach, and link what is at stake if the risk is asset-based.
- Name the threat and the vulnerability, and record any existing controls.
- Send for approval.
Scoring, the treatment option and the selected controls come later, at the control step. See Lifecycle.
Write the definition as a sentence with a cause and a consequence — an unpatched server being exploited and customer data disclosed — rather than as a noun phrase like "web server". The register is read by people looking for scenarios, and a threat and a vulnerability on their own do not make one.