CompTIA Security+ SY0-701 · Free study guide

Objective 5.2 — Apply a structured risk management process

Risk management identifies uncertainty that could affect objectives, analyzes likelihood and impact, assigns ownership, chooses treatment, and monitors the result. A risk register is a decision record, not a graveyard of vague concerns.

Assessments can be ad hoc, one-time, recurring, or continuous. Use a cadence that matches how quickly exposure changes. Qualitative analysis uses ordered descriptions such as low, medium, and high. Quantitative analysis estimates numeric loss, but precision should not be confused with certainty.

Quantitative relationships

Exposure factor is the expected percentage loss from one event. Single loss expectancy (SLE) equals asset value multiplied by exposure factor. Annualized rate of occurrence (ARO) estimates events per year. Annualized loss expectancy (ALE) equals SLE multiplied by ARO.

If a $200,000 process would lose 25% of its value per incident, SLE is $50,000. If the event is expected once every four years, ARO is 0.25 and ALE is $12,500. These estimates help compare options; they do not guarantee the next loss.

Decide and monitor

Transfer shifts some consequence through insurance or contract. Accept means an authorized owner knowingly retains the risk. Avoid stops the risky activity. Mitigate reduces likelihood or impact. Exceptions and exemptions should not be disguised acceptance by an unauthorized person.

Risk appetite expresses the broad amount and type of risk the organization is willing to pursue or retain. Tolerance and thresholds make boundaries operational. Key risk indicators reveal movement toward those boundaries. Each register entry should include scenario, assets, existing controls, likelihood, impact, treatment, owner, due date, residual risk, and review trigger.

A business impact analysis identifies critical processes and dependencies. RTO is the restoration target; RPO is the acceptable data-loss window. Mean time to repair describes average restoration effort, while mean time between failures describes reliability across events. Do not substitute observed averages for business targets.

Decision rule: describe cause, event, and impact; use transparent assumptions; assign an authorized owner; select treatment; and monitor residual risk against appetite and tolerance.