3.3. Reflection Checkpoint

Key Takeaways

• Risk requires all four elements — threat, vulnerability, likelihood, and impact — to exist at all; a severe threat against a well-controlled asset can still be low risk.
• Threat intelligence and horizon scanning are meant to identify risk before an exploit exists, not after.
• Quantitative analysis (like ALE) is only as trustworthy as its underlying data — it is a complement to qualitative judgment, not a strictly superior replacement.
• Every risk treatment option (accept, mitigate, transfer, avoid) reshapes the risk; none eliminate it outright.
• Risk owner and control owner are frequently different roles, and both must stay engaged — and risk monitoring must continue after treatment, since residual risk changes over time.

Connecting Forward

Phase 4 takes the risk decisions this phase produces and turns them into an actual, resourced information security program — the policies, controls, and operations that carry out what governance authorized and risk management prioritized.

Self-Check Questions

• Why does a severe threat against a well-controlled asset not automatically mean high risk?
• If a risk owner and a control owner disagree about whether a control is worth its operational cost, whose judgment should ultimately govern the decision, and why?