6.2.1. Risk Identification and Assessment

💡 First Principle: Before you can manage risk, you must identify and understand it. Risk identification systematically catalogs threats, vulnerabilities, and the assets they could affect. Risk assessment evaluates the likelihood and impact of each risk scenario. Without identification, risks remain invisible; without assessment, all risks appear equal.

Risk identification involves cataloging threats (who/what could cause harm), vulnerabilities (weaknesses that could be exploited), and assets (what you're protecting). Sources include threat intelligence feeds, vulnerability scans, audit findings, incident history, industry reports, and employee interviews. The goal is comprehensive coverage — undiscovered risks can't be managed. Risk identification should consider internal threats (insider actions, system failures), external threats (attackers, natural disasters), and emerging threats (new attack techniques, regulatory changes).

Assessment types by frequency:

Ad hoc risk assessment — informal, unstructured assessment performed as issues arise. Fast but inconsistent and prone to bias. Useful for quick evaluation of unexpected situations.

Recurring risk assessment — scheduled periodic assessments (quarterly, annually). Ensures risks are regularly re-evaluated as the environment changes. Most organizations conduct formal risk assessments at least annually, with quarterly reviews for high-risk areas.

One-time risk assessment — focused assessment for specific events: new system deployment, merger/acquisition, regulatory change, or major architectural change. Triggered by events rather than schedules.

Continuous risk assessment — ongoing automated monitoring using real-time data from vulnerability scanners, threat feeds, and security tools. Most mature but most resource-intensive. Provides the fastest detection of new risks but requires significant tool investment and analyst capacity. Organizations often use continuous assessment for critical assets and periodic assessment for everything else.

⚠️ Exam Trap: Continuous risk assessment uses automated tools for real-time monitoring — it's always running. Recurring assessment is periodic and scheduled — it happens on a calendar. The exam may describe a scenario and ask which assessment type is most appropriate based on the organization's maturity, risk level, and resources.