Risk assessment
Also known as: Risk analysis, Threat assessment, Vulnerability assessment
A risk assessment is a systematic process used to identify potential threats and vulnerabilities that could negatively impact an organization's operations or assets. It involves analyzing the likelihood of these events occurring and evaluating the severity of their resulting impact. This process allows organizations to prioritize which risks require mitigation and which can be accepted based on their specific risk appetite.
In practice
During a compliance audit, a practitioner will review the organization's Risk Register to ensure that identified high-priority risks are mapped to specific security controls. They verify that the assessment was conducted by qualified personnel and updated recently to reflect changes in the technical or regulatory environment.