Be able to choose an appropriate risk assessment methodology, define appetite and tolerance, run a documented exception and acceptance process, and translate results into board-level reporting. The single most important thing: keep every risk decision tied to business objectives and owned at the correct authority level.
Start practicing
Risk Management — choose a session length
Free · No account required
Domain overview
Domain 3 of the CISSP-ISSMP covers building and running the enterprise risk program: selecting risk assessment methodologies, defining risk appetite and tolerance, maintaining a formal risk management policy, operating exception and acceptance processes, and reporting risk posture to executive leadership and the board. Questions are scenario-based management judgments, not technical control configuration.
Exam objectives
Selecting qualitative, quantitative, or hybrid risk assessment methodologies such as OCTAVE, FAIR, and NIST SP 800-30
Defining risk appetite, risk tolerance, and risk acceptance criteria aligned to organizational objectives
Operating the exception process for granting, documenting, and time-limiting deviations from policy or standards
Producing risk heat maps and dashboards that communicate likelihood, impact, and residual risk to the board
Treating risk assessment methodologies as tools to memorize rather than matching method to business context, data availability, and decision needed
Confusing risk appetite (how much risk leadership will pursue) with risk tolerance (acceptable variation around a specific objective)
Assuming an exception permanently waives a control instead of being time-bound, documented, approved at the right authority, and periodically reviewed
Click any question to see the full explanation and answer options, or start a focused practice session above.
Which document is the primary source for defining the 'Risk Appetite' of an enterprise?
2Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?
3A Chief Risk Officer is utilizing the FAIR framework to quantify cyber risk. Which input is required to calculate the Loss Event Frequency?
4When integrating risk management with the SDLC, which activity represents the most effective 'Shift-Left' approach to mitigate design-level risk?
5Which risk response strategy is being employed when a company purchases cyber insurance?
6Which of the following best describes the 'Risk Management Framework' (RMF) process step of 'Assess'?
7In the context of ISO 31000, what is the primary purpose of 'Risk Communication and Consultation'?
8When executive leadership discusses 'Acceptable Risk', they are referring to:
9An ISSMP is reviewing an organizational risk register. Which field is essential for effective risk prioritization?
10Your organization is performing a supply chain risk assessment. Which factor is most critical when evaluating a critical software vendor?
11During a merger, you identify two different risk assessment methodologies. What is the best strategy for the ISSMP?
12What is the primary objective of a Business Impact Analysis (BIA)?
13Which of the following is an example of a detective control in a risk management program?
14An enterprise is moving to a 'Zero Trust' architecture. How does this impact the risk assessment process?
15You are utilizing a quantitative risk analysis. What is the 'SLE' in the context of an ARO-based calculation?
16An organization is concerned about 'Cloud Concentration Risk'. What is the best mitigation strategy?
17When evaluating the effectiveness of a risk mitigation strategy, which stakeholder is most critical to involve in the sign-off process?
18What is the primary function of an 'Exception Process' in a risk management program?
19Which of the following is a 'Leading Indicator' for an enterprise risk management program?
20In the context of risk reporting, what does a 'Risk Heat Map' effectively communicate to the board?
21Which TWO of the following are primary components of a formal Risk Management policy?
22What is the primary difference between a 'Risk Assessment' and a 'Vulnerability Assessment'?
23When performing a risk assessment on a new SaaS implementation, which document is most useful for understanding the vendor's risk profile?
24When presenting a risk treatment plan to the Board of Directors, which THREE elements should be included to ensure executive buy-in?
25Which TWO methods are commonly used to identify new risks in an enterprise environment?
26When assessing the risk of a third-party service provider, which THREE areas should be evaluated?
27Which TWO actions are part of the 'Risk Monitoring' process?
28Which TWO of the following are valid responses to a high-risk finding?
29When building an Enterprise Risk Management (ERM) program, which THREE factors must be considered to ensure integration with the organization?
30When conducting a risk assessment on an IoT ecosystem, which THREE factors are specifically critical?
31Which THREE criteria are essential for establishing a successful 'Risk Committee'?
32Which THREE of the following are considered 'Risk Assessment' methodologies?
33Which TWO of the following are common challenges in quantitative risk analysis?
34Which TWO factors should be used to weigh the 'Impact' in a risk assessment?
35A financial services firm is expanding its risk management program to include cyber risk quantification. The CISO wants to express cyber risk in monetary terms to compare it with other business risks. Which approach best aligns with this objective?
36A multinational corporation is integrating its risk management program with its enterprise risk management (ERM) framework. The ISSMP is tasked with ensuring that risk appetite and tolerance are effectively communicated and applied across all business units. Which TWO actions are most critical to achieve this integration? (Choose two.)
37A healthcare organization is conducting a risk assessment for a new telehealth platform that will store protected health information (PHI). The ISSMP must ensure that the assessment adequately addresses regulatory requirements. Which of the following should be the PRIMARY focus of the risk assessment?
38A global financial services firm has completed a quantitative risk analysis for its primary trading platform. The analysis shows an annualized loss expectancy (ALE) of $4.2 million. The platform owner proposes a $1.1 million annual security program that would reduce the ALE to $900,000. The Chief Information Security Officer (CISO) must decide whether to recommend funding. The organization's risk appetite statement permits a maximum residual ALE of $1.5 million for critical systems. Which decision is most appropriate?
39A healthcare organization is integrating risk management into its enterprise architecture practice. The Chief Risk Officer (CRO) wants to ensure that new technology initiatives are evaluated for risk before funding is approved. Which activity best demonstrates that risk management is embedded in the architecture governance process?
40A global financial services firm is expanding its enterprise risk management (ERM) program to include third-party risk. The CISO wants to ensure that the risk appetite for third-party relationships is consistently applied across all business units. Which of the following is the MOST effective way to achieve this?
41A healthcare organization is conducting a risk assessment for a new telehealth platform that will store protected health information (PHI). The risk team has identified that the platform's encryption at rest uses a deprecated algorithm. The vendor cannot upgrade the algorithm for another six months due to contractual constraints. Which of the following is the BEST risk response?
42A multinational corporation is integrating its risk management program with its supply chain management. The CISO wants to ensure that risk assessments are performed consistently for all suppliers. Which of the following is the MOST important factor to consider when defining the risk assessment criteria?
43A financial services firm uses a risk matrix with likelihood and impact scales. During a risk assessment, the team identifies a new vulnerability in a core banking application. The likelihood is rated as 'Possible' (3 on a 1-5 scale) and the impact as 'Major' (4 on a 1-5 scale). The organization's risk appetite statement says that risks with a score of 12 or higher require immediate treatment. What is the risk score and what action should be taken?
44A security manager is presenting a risk register to the executive committee. One risk item shows a high likelihood and high impact, but the risk owner has proposed a treatment plan that requires significant funding. The executive committee asks for justification. Which of the following is the BEST approach to justify the investment?
45A multinational corporation is implementing an Enterprise Risk Management (ERM) program. The Chief Risk Officer wants to ensure that risk management is integrated into strategic planning. Which of the following activities best demonstrates this integration?
46A security manager is developing a risk treatment plan for a critical vulnerability in a web application. The vulnerability allows remote code execution and has a high likelihood of exploitation. The organization has a low risk appetite. Which TWO of the following are the MOST appropriate risk treatment options to consider? (Choose two.)
47A global retailer is expanding its risk management program to include third-party vendors. The Chief Information Security Officer (CISO) is concerned about supply chain risks. Which TWO of the following are the most effective controls to mitigate third-party risk? (Choose two.)
48A software development company is integrating risk management into its DevOps pipeline. The security team wants to implement a control that automatically scans code for vulnerabilities before deployment. Which of the following best describes this type of control in the context of risk management?
Be able to choose an appropriate risk assessment methodology, define appetite and tolerance, run a documented exception and acceptance process, and translate results into board-level reporting. The single most important thing: keep every risk decision tied to business objectives and owned at the correct authority level.
The Courseiva ISC question bank contains 48 questions in the Risk Management domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Risk Management domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included