What is the single biggest reason a multi-million-pound company goes bankrupt due to a cyber attack? It is not the technology failure itself — it is the failure to identify and manage the risk before it happens. Risk management gives you a repeatable process to answer: 'What could go wrong, how bad would it be, and what should I do about it?' For the CAS-005 exam, you must understand both the frameworks (like NIST and ISO 31000) and the methods (qualitative and quantitative) that professionals use to make these decisions under uncertainty.
Jump to a section
A simple way to picture Risk Management and Assessment Methodologies
You are planning to renovate your kitchen. How do you decide whether to spend your savings on new granite countertops or reinforce the floor joists before they collapse?
That decision is risk management. First, you identify the risks: the joists might rot (hazard), the countertop installer might ghost you (loss of time), or a sudden economic downturn might leave you short of cash (financial risk). You then assess each risk. What is the probability that the joists fail? High, because the house is old. What is the impact? Catastrophic — the stove crashes through the floor. That combination (high probability x high impact) gives the joists a high risk score. The countertop delay? Low probability, low impact. You prioritise: fix the joists first.
Next, you choose how to treat each risk. You can avoid the rotten-joist risk by installing a new support beam. You can transfer the cost by buying home insurance. You can accept the risk of a minor delay because you are flexible. Finally, you monitor: you inspect the floor each week during construction. This whole process — identify, assess, prioritise, treat, monitor — mirrors precisely how organisations use qualitative (gut-check ranking) and quantitative (dollar-value calculation) methodologies to manage cybersecurity risks. Just as you protect your home's structural integrity first, IT professionals protect their systems and data.
Risk management is the process of identifying, analysing, and responding to factors that could negatively affect an organisation. For the SecurityX exam, you need to know two broad categories of assessment methodologies: qualitative and quantitative.
Let us start with the core definitions. A risk is the likelihood that a threat will exploit a vulnerability and cause harm. A threat is anything that can cause damage — for example, a hacker, a fire, or a power outage. A vulnerability is a weakness — for example, an unpatched software bug or a door with no lock. The combination of a threat acting on a vulnerability creates risk.
Qualitative risk assessment uses subjective judgements to rank risks by categories like 'High', 'Medium', or 'Low'. It does not use hard numbers. You might gather a team of experts, ask them to discuss each risk, and then vote. The result might be a heat map: a red square for 'high likelihood and high impact', a yellow square for 'medium', and a green square for 'low'. This method is quick and does not require statistical data. It is excellent for getting started when you have little information. The down side is that it can be biased by the strongest personality in the room.
Quantitative risk assessment uses actual data and calculations to assign monetary values. The two key metrics are Single Loss Expectancy (SLE) and Annualised Rate of Occurrence (ARO). SLE is the cost of a single incident — for instance, if a data breach costs £500,000 to investigate and notify customers. ARO is how many times you expect the incident to happen per year — for example, 0.2 (once every five years). Multiply them: Annualised Loss Expectancy (ALE) = SLE x ARO. So 500,000 x 0.2 = £100,000 per year. This gives you a concrete figure to compare against the cost of a control — like buying a firewall for £50,000 per year. If the control costs less than the ALE, it is worth the investment. Quantitative analysis is objective but requires good data, which is often hard to get.
The exam also tests frameworks that organise risk management. The most important to know are:
NIST Risk Management Framework (RMF): A six-step process from the US government. The steps are Categorise, Select, Implement, Assess, Authorise, and Monitor. It is prescriptive and focuses on compliance.
ISO 31000: A generic international standard. Its steps are Establish Context, Identify Risks, Analyse Risks, Evaluate Risks, and Treat Risks. It is principles-based and flexible for any industry.
FAIR (Factor Analysis of Information Risk): A quantitative-only framework. It breaks down risk into factors like threat event frequency and vulnerability magnitude. It is used when you need a dollar value.
COBIT: A governance framework that aligns IT goals with business goals. It includes risk management as part of a broader control environment.
Why do organisations use frameworks? Without a repeatable process, risk management becomes a chaotic list of fears. Frameworks provide a common language. For example, if a security manager says 'We need to apply NIST RMF step 3 (Implement),' everyone knows they must deploy the specific security controls they selected in step 2. This consistency is critical for audits.
Finally, you treat risks through one of four strategies:
Avoid: Stop the activity that creates the risk. For example, you might decide not to store sensitive customer data at all.
Transfer: Shift the risk to a third party. Buying cyber insurance is the classic example.
Mitigate: Reduce the likelihood or impact. Installing a firewall reduces the likelihood of a network intrusion.
Accept: Acknowledge the risk and take no action. This is appropriate when the cost of a control exceeds the potential loss.
A fifth strategy, 'Escalate', is sometimes used: you raise the issue to higher management who have the authority to decide. The CAS-005 exam expects you to match each risk treatment to its definition and to recognise that 'acceptance' requires formal documentation — it is not just ignoring a problem.
In summary, risk management is not about eliminating all risk; it is about making informed decisions. You prioritise the risks that matter most, choose the most cost-effective treatment, and monitor continuously. This is the core of domain 1.2.
Establish Context
Before assessing any risk, define the business objectives, scope, and risk appetite of the organisation. For example, a hospital has a low appetite for patient data loss, so it will accept different risks than a startup. This step sets the boundaries and criteria for the entire process.
Identify Risks
List all possible threats and vulnerabilities that could affect the assets being analysed. Use brainstorming, threat modelling, or checklists. For an online payment portal, this might include hackers, software bugs, and server failures. You cannot manage a risk you have not identified.
Analyse Risks
Determine the likelihood and potential impact of each identified risk. In a qualitative method, this means assigning a rating like 'High' for likelihood and 'High' for impact. In a quantitative method, you calculate SLE and ARO. This step converts a list of worries into prioritised data.
Evaluate and Prioritise Risks
Compare the analysed risks against the risk criteria set in step 1. Decide which risks need treatment and in what order. A risk with high likelihood and high impact is prioritised over one with low likelihood and low impact. This step produces a heat map or a ranked list.
Treat Risks
Select and implement one of the four responses: Avoid, Transfer, Mitigate, or Accept. Document the chosen treatment and assign an owner. For example, for a server crash risk, you might mitigate by purchasing redundant servers. This step reduces risk to an acceptable level (residual risk).
Monitor and Review
Continuously track the risk environment, the effectiveness of treatments, and any new risks. Update the risk register regularly. This step ensures that risk management remains current and that controls continue to work as intended. It feeds back into step 1, creating a continuous loop.
Sophie is the IT security manager for a medium-sized UK retailer. The company is about to roll out a new online payment portal. Before launch, her boss asks: 'What are the risks, and should we go live?'
Sophie begins with a qualitative risk assessment. She gathers five department heads — finance, IT, operations, legal, and marketing — for a two-hour workshop. She asks them to list everything that could go wrong with the payment portal. The team brainstorms threats: a hacker stealing credit card numbers, a server crash during Black Friday, a software bug that processes the wrong amounts, and a legal issue with GDPR for mishandled data. They rate each threat on a scale of 1 to 5 for likelihood and impact. The hacker threat scores a 5 for impact (reputation damage, fines) but only a 2 for likelihood because the company uses good encryption. The server crash scores a 4 for likelihood (it has happened before) and a 3 for impact. Sophie creates a heat map: the server crash lands in the 'High' quadrant, the hacker threat in 'Medium'. The team agrees: fix the server capacity issue first.
Now Sophie needs to justify the cost of new servers to the finance director. She switches to a quantitative method. She calculates the ALE for a server crash. The Single Loss Expectancy is £80,000 (lost sales during downtime, overtime pay for IT staff, and customer compensation). The Annualised Rate of Occurrence is 0.5 (she expects a crash every two years based on past data). The ALE is £40,000. New server infrastructure costs £60,000 per year. At first, the cost seems too high. But Sophie refines her data: she adds the risk of customer churn, which brings the SLE up to £120,000. Now the ALE is £60,000 – exactly equal to the control cost. The finance director approves the purchase because the benefit (avoiding £60,000 annual loss) matches the expense.
Over the next year, Sophie monitors the risk. She uses a risk register — a spreadsheet or tool that tracks each identified risk, its current rating, the treatment plan, and the owner. She updates the register quarterly. When the company migrates to a cloud provider, she reassesses the server crash risk because the cloud provider has built-in redundancy. The likelihood drops to 0.1. She records this change and re-prioritises.
Sophie also uses a framework. The company is subject to the UK's GDPR regulations, which require her to follow a recognised risk management approach. She chooses ISO 31000 because it is flexible and integrates easily with the company's existing project management process. She documents every step for the auditors.
Finally, Sophie presents a quarterly risk report to the board. She uses simple charts: a heat map for the board to see the top three risks, a graph showing the ALE trend for the payment portal, and a list of accepted risks with sign-off. The board uses this to decide budgets and priorities for the next quarter. Without this systematic approach, the company would be reacting to incidents instead of preventing them. This is exactly what an IT professional does with risk management daily.
The CAS-005 exam tests risk management in both multiple-choice and performance-based questions (PBQs). You must be able to do three things: define terms precisely, calculate ALE, and match risk treatments to scenarios.
The exam authors love to test the difference between qualitative and quantitative methods. A typical question gives you a scenario: 'An organisation rates risks as High, Medium, or Low based on expert judgement. Which methodology are they using?' The answer is qualitative. The trap is that some questions describe a hybrid method (like using expert judgement to assign numerical scores), which is still qualitative because the scores are subjective. Always look for the presence of actual monetary values — that is the key sign of a quantitative approach.
Calculation questions will give you SLE and ARO and ask for ALE, or give you ALE and ARO and ask for SLE. Memorise the formula: ALE = SLE x ARO. You will not have a calculator, so the numbers will be simple — for example, SLE of £10,000 and ARO of 0.5 = ALE of £5,000. A common trap is confusing ARO with likelihood percentage; ARO is a frequency (number of times per year), not a percentage. Watch for questions that try to trick you into multiplying by 100.
Another frequent exam topic is the four risk treatment strategies. They will list a scenario and ask: 'Which risk response is the company using?' Example: 'A company buys cyber insurance to cover losses from a data breach.' This is transfer. A trap: if the scenario says 'the company decides to discontinue the online service that carries the risk', do not choose mitigate — choose avoid. Mitigate reduces the risk, but avoid eliminates the activity entirely.
The exam also tests frameworks, specifically NIST RMF and ISO 31000. You need to know the order of steps in NIST RMF: Categorise, Select, Implement, Assess, Authorise, Monitor. A common PBQ asks you to drag the steps into the correct sequence. A trap is putting 'Assess' before 'Implement' — you must implement controls before you can assess their effectiveness. Another trap: confusing 'Authorise' (a senior official signs off to accept the residual risk) with 'Assess' (evaluation of controls).
Key concepts you must memorise:
SLE (Single Loss Expectancy) = Asset Value x Exposure Factor (the percentage of value lost in an incident).
ARO (Annualised Rate of Occurrence) = expected frequency per year.
ALE (Annualised Loss Expectancy) = SLE x ARO.
Risk = Threat x Vulnerability x Impact.
Qualitative uses rankings (High/Medium/Low). Quantitative uses monetary values.
The four risk responses: Avoid, Transfer, Mitigate, Accept.
NIST RMF steps in order (Categorise, Select, Implement, Assess, Authorise, Monitor).
ISO 31000 steps: Establish Context, Identify, Analyse, Evaluate, Treat.
A risk register documents all identified risks, their ratings, treatments, and owners.
Finally, the exam will test the concept of residual risk — the risk that remains after you apply a control. A question might say: 'After installing a firewall, the risk of a network intrusion is reduced but not eliminated. What is this remaining risk called?' Answer: residual risk. A related trap: inherent risk is the risk before any controls. Do not mix them up.
Risk is the product of threat, vulnerability, and impact — if any is zero, there is no risk.
Qualitative risk assessment uses subjective rankings (High/Medium/Low); quantitative uses monetary values (SLE, ARO, ALE).
The four risk treatment strategies are Avoid, Transfer, Mitigate, and Accept — never just 'ignore'.
NIST RMF follows six sequential steps: Categorise, Select, Implement, Assess, Authorise, Monitor.
Risk acceptance is a formal, documented decision by authorised management, not inaction.
A risk register is a living document that tracks all identified risks, their ratings, treatments, and owners.
These come up on the exam all the time. Here's how to tell them apart.
Qualitative Risk Assessment
Uses subjective rankings like High, Medium, Low
Does not require statistical data or monetary values
Results in a heat map or priority list
Quantitative Risk Assessment
Uses hard numbers like SLE, ARO, and ALE
Requires accurate historical data and asset valuations
Results in a specific monetary figure for comparison
Risk Mitigation (Reduce)
Involves implementing controls to lower likelihood or impact
Organisation retains the residual risk after controls
Example: installing a firewall to reduce intrusion risk
Risk Transfer
Shifts financial risk to a third party (e.g., insurance)
Organisation no longer bears the full loss
Example: buying cyber insurance for data breach costs
Inherent Risk
The level of risk before any controls are applied
Often very high because no safeguards exist
Used to justify the need for security investments
Residual Risk
The level of risk after controls are applied
What management formally accepts if not further reduced
Must be documented in the risk register
NIST Risk Management Framework (RMF)
Six-step process: Categorise, Select, Implement, Assess, Authorise, Monitor
Mandatory for US federal agencies
Control-oriented and compliance-driven
ISO 31000
Generic five-step process: Context, Identify, Analyse, Evaluate, Treat
Applicable to any organisation worldwide
Principles-based and adaptable to any sector
Mistake
Risk management is only about preventing bad things from happening.
Correct
Risk management also involves accepting risks and even taking calculated risks that can bring business advantages, such as launching a new product despite potential security concerns.
People naturally focus on prevention because threat warnings are dramatic. The exam deliberately tests your understanding that risk acceptance is a valid, documented strategy.
Mistake
Quantitative risk assessment is always better because it uses numbers.
Correct
Quantitative methods require accurate data which is often unavailable or unreliable. Qualitative methods are faster, cheaper, and perfectly adequate for many decisions.
Many beginners assume numbers are always more accurate. In reality, the 'precision' of quantitative analysis can be false if the input data is guesswork.
Mistake
Once you have a risk register, you are done with risk management.
Correct
Risk management is a continuous process. Risks change as the business environment, technology, and threats evolve. You must review and update the register regularly.
People treat a risk register like a checklist that gets ticked once. The exam emphasises 'Monitor' as a step in every framework to counter this error.
Mistake
A risk treatment of 'accept' is the same as ignoring the risk.
Correct
Risk acceptance is a formal decision, typically in writing, by a senior manager who acknowledges the residual risk. Ignoring a risk is negligence, not a recognised strategy.
This confusion arises because both situations seem to involve doing nothing. The difference is a documented, authorised choice versus a lack of action.
Mistake
ALE stands for Annual Loss Expectation.
Correct
ALE stands for Annualised Loss Expectancy. It is the long-term average loss per year, not a prediction for the current year. The term 'Annualised' implies a mathematical scaling over a 12-month period.
The acronym contains 'Annualised' which sounds like 'Annual', leading beginners to drop the '-ised' and misstate the full term. The exam uses the precise phrase.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Qualitative uses subjective rankings like High, Medium, Low, while quantitative uses hard numbers like monetary values (SLE, ARO, ALE). Qualitative is faster; quantitative is more precise but requires good data.
ALE = SLE x ARO. SLE is the cost of one incident, and ARO is the number of times it occurs per year. For example, if SLE is £10,000 and ARO is 0.5, ALE is £5,000.
Choose acceptance when the cost of a control exceeds the potential loss (the ALE). It must be formally documented and signed off by management. It is not an excuse to ignore a risk.
Yes, you must remember the order: Categorise, Select, Implement, Assess, Authorise, Monitor. Expect drag-and-drop PBQ questions that test the sequence.
A risk register is a document that lists all identified risks, their ratings, treatment plans, and owners. The exam may test what information it contains and why it is updated continuously.
Yes, many organisations use a hybrid approach. For example, you might use qualitative for initial prioritisation and then quantitative to justify the cost of a specific control. The exam expects you to recognise hybrid scenarios.
You've finished Risk Management and Assessment Methodologies. Continue through the CAS-005 study guide to build a complete picture of the exam.
Done with this chapter?