Without a proper risk management process, your organisation might sink millions into protecting the wrong things — like buying a fireproof safe for a box of paperclips while letting customer credit card data float around unprotected. Information risk management is the structured method for figuring out which IT problems could actually hurt the business, how badly they could hurt it, and what you should do about them first. For the CISM exam, this is the single most important chapter because the entire certification is built on the idea that risk management drives every security decision.
Jump to a section
A simple way to picture Information Risk Management Concepts and Frameworks
Your house, on a quiet Tuesday afternoon. You hear a faint drip from the upstairs bathroom. You decide to ignore it because the kitchen renovation is more exciting. A month later, the ceiling in the dining room has a water stain. The wallpaper is peeling. The floorboards are starting to warp. You now face a cascade of damage that could have been a single, cheap pipe replacement.
This is information risk management. The drip is a vulnerability — a weakness in your system (the old pipe). A threat is the possibility of that pipe bursting. The risk is the combination: the likelihood the pipe will burst and the severity of the damage if it does. Your choice to ignore the drip is a risk acceptance decision. A proper risk assessment would have caught the drip early, quantified the potential damage (£5,000 in repairs vs. £50 for a new pipe), and prioritised the fix over the kitchen cabinets.
The risk management process gives you a structured way to find the drips, decide which are emergencies, and fix them before your dining room ceiling crashes down on your grandmother's china.
Information risk management is the formal process of identifying, analysing, evaluating, and treating risks that could threaten the confidentiality, integrity, or availability of information. Let us unpack what each of those words means.
Confidentiality means keeping information secret from people who should not see it. If a hacker steals your customer list, confidentiality is breached. Integrity means ensuring information is accurate and has not been tampered with. If someone changes a bank transfer amount from £100 to £10,000, integrity is lost. Availability means the information and systems are accessible when needed. If a ransomware attack locks your files, availability is gone.
Risk, in this context, is the effect of uncertainty on your objectives. It is mathematically expressed as the combination of the likelihood of a harmful event and the impact that event would have. Likelihood is often expressed as a probability (e.g., 10% chance next year). Impact is measured in pounds, reputational damage, legal penalties, or operational downtime.
A risk management process is a repeatable, documented cycle that an organisation follows to handle risks. The standard process, taught by CISM, has several phases:
Risk Identification: You find all potential risks. This is done through brainstorming sessions, reviewing past incidents, using threat intelligence feeds, and conducting vulnerability scans. The goal is to create a comprehensive list of everything that could go wrong.
Risk Analysis: You assess each identified risk to determine its likelihood and potential impact. This can be quantitative (using hard numbers, like 'this risk has a 5% chance of occurring and would cost £2 million') or qualitative (using rankings like High, Medium, Low).
Risk Evaluation: You compare the analysed risk levels against pre-defined risk criteria (the organisation's risk appetite — how much risk the company is willing to accept). Risks are then prioritised. High risks get immediate attention; low risks might be accepted or deferred.
Risk Treatment: You decide what to do about each risk. The four main treatment options are: avoid (stop the activity that creates the risk), mitigate (implement controls to reduce likelihood or impact), transfer (buy insurance, outsource to a vendor), or accept (do nothing and monitor).
Risk Monitoring and Review: Risks change over time. New threats emerge, systems change, and controls degrade. This phase is the continuous loop where you revisit each risk to see if the situation has changed and if your treatment choices still make sense.
For the CISM exam, you must understand that risk management is not about eliminating all risk. That is impossible. It is about making informed, defensible decisions about which risks to take and which to treat, based on business objectives. The process must be integrated into the organisation's overall governance structure, meaning senior leadership must be involved, and the process must align with the company's strategy.
CISM also emphasises the importance of a risk register. This is a living document that lists every identified risk, its analysis scores, the treatment decision, the person responsible, and the status of controls. The risk register is the master record of the entire risk management process and is a key artefact auditors will demand to see.
Establish Risk Management Context
Define the scope of the risk management process. Identify which assets, systems, and business processes are in scope. Determine the organisation's risk appetite and risk tolerance criteria. This step sets the rules of the game so that everyone knows what 'acceptable risk' looks like.
Identify Risks
Compile a comprehensive list of potential risks by identifying threats and vulnerabilities. Use tools such as vulnerability scanners, threat intelligence feeds, interviews with stakeholders, and reviews of past incidents. Every risk gets added to the risk register with a unique identifier.
Analyse Risks
For each risk, assess the likelihood that it will occur and the potential impact if it does. Choose between quantitative analysis (using monetary values and probabilities) or qualitative analysis (using ranking scales). Document the analysis alongside the risk in the register.
Evaluate and Prioritise Risks
Compare the analysed risk levels against the pre-defined risk appetite and tolerance criteria. Classify each risk as acceptable (no action needed) or unacceptable (action required). Prioritise the unacceptable risks from highest to lowest urgency so resources are allocated to the most dangerous ones first.
Treat Risks
Select one of the four treatment options (avoid, mitigate, transfer, accept) for each unacceptable risk. Design and implement controls for mitigation strategies. Document the treatment decision, the person responsible, and the residual risk level after treatment.
Monitor and Review
Continuously track all risks and controls. Set up regular review cycles (e.g., quarterly) to re-assess risks as the environment changes. Update the risk register with new threats, changes in likelihood or impact, and the effectiveness of controls. This is not a final step — it loops back to step 1.
An IT professional, let us call her Priya, works as an Information Security Manager at a mid-sized online retailer. Her company stores customer names, credit card numbers, and addresses. Here is how she uses the risk management process in practice.
Step 1: Identification. Priya wakes up to a report from her vulnerability scanner. It found that the web server running the payment portal has an unpatched software flaw (CVE-2024-1234). She also gets an email from the marketing team saying they want to move customer data to a new cloud storage service. She adds both as entries to the risk register.
Step 2: Analysis. Priya uses a qualitative risk matrix. For the unpatched web server, she determines likelihood is High (the exploit code is publicly available on the internet) and impact is Critical (if exploited, an attacker could access customer credit card data, leading to GDPR fines of up to £20 million). The combined risk level is 'Very High'. For the new cloud storage project, she assesses likelihood as Low (the vendor seems reputable) but impact as High (if they suffer a data breach, customer data is exposed). She scores that as 'Medium' risk.
Step 3: Evaluation. Priya presents the risk register to the steering committee. The committee has a risk appetite statement that says they will accept any risk rated 'Low' without further action, but 'Very High' risks must be treated immediately. They approve her recommendation to treat the web server vulnerability as a top priority.
Step 4: Treatment. For the web server, Priya chooses to mitigate. She applies the vendor patch within 4 hours and adds an intrusion prevention system rule to block any attempts to exploit the old vulnerability. She documents the cost (£500 for overtime) and the residual risk (Low, since no known exploits exist for the patched version).
Step 5: Monitoring. Priya sets up automated alerts. If the same vulnerability type reappears, her SIEM (Security Information and Event Management) system will notify her. She also schedules a quarterly review of all risk register entries with the department heads.
This process is not a one-time project. It is a continuous, recurring cycle that Priya runs monthly, feeding results into the company's annual budget planning and strategic decisions.
CISM tests your understanding of risk management concepts more than any other topic. Expect 25-30% of your exam questions to come from this domain. Here is exactly what they test and how they try to trick you.
Core concepts the exam loves:
The difference between a threat (a potential cause of harm), a vulnerability (a weakness), and a risk (the combination of threat and vulnerability with a measurable impact). A question might describe a hacker (threat) exploiting an unpatched system (vulnerability) resulting in a data breach (risk). You must identify each element.
The four risk treatment options: avoid, mitigate, transfer, accept. They love to test whether you can pick the right one for a given scenario. Trap: 'Risk avoidance' is NOT the same as 'risk mitigation'. Avoidance means killing the activity entirely; mitigation means reducing the harm while keeping the activity.
Risk appetite vs. risk tolerance. Risk appetite is the amount of risk the organisation is willing to accept in general. Risk tolerance is the acceptable variation around a specific objective. Example: a bank might have a low risk appetite for credit fraud but a higher risk tolerance for marketing campaigns.
Quantitative vs. qualitative risk analysis. You must know when to use each. Quantitative requires reliable data and is used for high-impact financial decisions. Qualitative is faster and used for general prioritisation. Trap: they will ask you to calculate Single Loss Expectancy (SLE) or Annualised Loss Expectancy (ALE). Formula: SLE = Asset Value x Exposure Factor. ALE = SLE x Annualised Rate of Occurrence. Memorise these.
Common question trap patterns:
They give you a scenario where the company needs to comply with a regulation (like GDPR or HIPAA). The correct answer will usually involve risk treatment combined with compliance requirements, not just risk treatment alone.
They describe a risk that has been accepted. The question might ask, 'What should the manager do next?' The answer is always: monitor the risk and review it periodically. Not 'ignore it'.
They confuse risk ownership (the person responsible for the risk) with risk management (the process). Risk owners are usually business line managers, not the security team. The security manager facilitates the process, but the business owns the risk.
Key definitions to memorise verbatim:
Risk: The effect of uncertainty on objectives.
Vulnerability: A weakness in an asset or control that can be exploited by a threat.
Threat: Any circumstance or event with the potential to cause harm to an asset.
Control: A safeguard that modifies risk.
Residual Risk: The risk remaining after controls have been applied.
Inherent Risk: The risk before any controls are applied.
Risk is the effect of uncertainty on objectives, calculated as a combination of likelihood and impact.
The four risk treatment options are avoid, mitigate, transfer, and accept — and each is a valid business decision.
Risk appetite is the amount of risk the organisation is willing to accept; risk tolerance is the acceptable deviation from specific objectives.
The risk register is the central, living document that records all identified risks, their analysis, and treatment decisions.
Residual risk is the risk that remains after controls are applied; inherent risk is the risk before any controls exist.
Risk management is a continuous, recurring process, not a one-time project; it must be integrated into the organisation's governance framework.
The information security manager facilitates the risk management process, but business line managers own the risks and make the final decisions.
Quantitative risk analysis uses hard numbers (SLE, ALE); qualitative risk analysis uses rankings (High, Medium, Low); you must choose the method that fits your data availability.
These come up on the exam all the time. Here's how to tell them apart.
Threat
A potential cause of harm, e.g., a hacker, fire, or flood.
Exists independently of any specific system.
Cannot be controlled by the organisation (you cannot stop all hackers).
Vulnerability
A weakness in a system or control, e.g., unpatched software.
Exists only in relation to a specific asset.
Can be fixed or reduced by the organisation (e.g., applying a patch).
Inherent Risk
The level of risk before any controls are applied.
Represents the raw danger of an activity.
Used to assess whether controls are even worth implementing.
Residual Risk
The level of risk after all controls have been applied.
Represents what the organisation actually lives with.
Must be formally accepted by management and monitored.
Risk Appetite
The broad, high-level amount of risk the organisation is willing to accept.
Set by the board or senior management as a statement.
Example: 'We are a risk-averse financial institution.'
Risk Tolerance
The acceptable variation around a specific objective.
More granular and operational.
Example: 'We will accept up to 2% fraud loss on credit card transactions.'
Quantitative Risk Analysis
Uses hard numbers: monetary values, percentages, probabilities.
Produces precise figures like SLE and ALE.
Requires accurate, reliable data which may be expensive to obtain.
Qualitative Risk Analysis
Uses rankings: High, Medium, Low, or scales of 1-5.
Produces relative prioritisation rather than exact numbers.
Faster and cheaper; good for initial screening and when data is scarce.
Risk Mitigation
You implement controls to reduce likelihood or impact.
The organisation retains ownership of the risk.
Examples: installing a firewall, training staff, encrypting data.
Risk Transfer
You shift the financial burden of the risk to another party.
The risk event still affects the organisation, but the cost is covered elsewhere.
Examples: buying cyber insurance, outsourcing to a vendor with a service-level agreement.
Risk Owner
The person who is accountable for the risk and its treatment.
Usually a business line manager (e.g., head of sales, CFO).
Their role is to make decisions about risk acceptance and treatment.
Risk Manager
The person who facilitates the risk management process.
Usually the information security manager or a dedicated risk manager.
Their role is to provide expertise, document risks, and advise the risk owner.
Mistake
Risk management is only for the IT department. The business leaders just need to approve budgets.
Correct
Risk management is a business process, not an IT process. IT implements the technical controls, but the business leadership must define risk appetite, own the risks, and make the final decisions on treatment. CISM teaches that the information security manager acts as a facilitator and advisor to the business.
Many beginners come from technical backgrounds and assume security is solely an IT concern. The CISM exam explicitly tests the governance aspect, where the board and senior management are accountable, not the IT team.
Mistake
Once you treat a risk by implementing a control, the risk is gone forever.
Correct
Controls degrade over time. New threats emerge. The environment changes. Risk management is a continuous cycle of monitoring and re-evaluation. No control is perfect, and residual risk always remains.
This mistake stems from the common project-based thinking pattern: 'we did the project, now it is done.' Security controls require ongoing maintenance and validation.
Mistake
Risk assessment is the same thing as a vulnerability scan.
Correct
A vulnerability scan is one tool used during the risk identification phase. A full risk assessment includes identifying threats, analysing likelihood and impact, comparing results to risk appetite, and prioritising treatment decisions. A scan produces a list of technical weaknesses; a risk assessment produces business decisions.
Beginners often see the technical output of a vulnerability scanner and think that is the entire assessment. They do not grasp that the business context (what data is on that system, how critical is it) transforms a technical finding into a business risk.
Mistake
Risk acceptance means you are doing nothing and ignoring the problem.
Correct
Risk acceptance is a deliberate, documented decision by a manager with the authority to accept the risk. It requires a formal acknowledgement that the risk exists and the impact is understood, but the cost of treatment outweighs the potential loss. The accepted risk must be tracked and periodically reviewed.
People confuse 'ignoring a problem' with 'formally accepting it.' CISM expects you to recognise that acceptance is a valid treatment option when done properly and formally.
Mistake
Quantitative risk analysis is always better than qualitative risk analysis.
Correct
Quantitative analysis gives you precise numbers but requires accurate data, which is often unavailable or too expensive to gather. Qualitative analysis is faster, easier to communicate to executives, and sufficient for prioritising most risks. Each has its proper use case.
Beginners think numbers are always superior. In practice, many risks (like reputational damage) are extremely difficult to quantify accurately. CISM tests that the method chosen must fit the context and available data.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A threat is a potential cause of harm, like a hacker or a fire. Risk is the combination of the likelihood that the threat will exploit a vulnerability and the impact that would have. A threat by itself is not a risk until it has a probability and a consequence attached to it.
Risk appetite is how much danger the organisation is comfortable with. It is like deciding how fast you are willing to drive on a curvy road. A conservative driver (low risk appetite) will drive slowly, while a thrill-seeker (high risk appetite) may push the speed limit. The board defines this for the entire company.
Use quantitative analysis when you have reliable data (e.g., historical loss figures, vendor quotes) and need to calculate precise costs, like for insurance or budgeting. Use qualitative analysis when data is scarce and you need a quick prioritisation. Most organisations use both: qualitative for initial screening, then quantitative for the top risks.
A risk register is a document (often a spreadsheet or database) that lists every identified risk, its likelihood and impact scores, the treatment decision, the person responsible, and the status of controls. It is important because it provides a single source of truth for the entire risk management process and is the first thing auditors will inspect.
The business line managers who own the assets and processes are responsible for managing the risks. The information security manager facilitates the process, provides expertise, and advises on controls, but the ultimate accountability lies with business leadership.
Residual risk is the risk that remains after you have applied all your controls. No control is 100% effective, so you never eliminate risk completely. Residual risk must be formally accepted by management and monitored over time.
Risk avoidance means stopping the activity entirely. For example, if using a third-party service is risky, you cancel the contract (avoid). Risk mitigation means you keep the activity but reduce the risk. For example, you add strong encryption and monitoring to the third-party service (mitigate).
You've finished Information Risk Management Concepts and Frameworks. Continue through the CISM study guide to build a complete picture of the exam.
Done with this chapter?