# Risk Management and Security Controls

> Chapter 4 of the Courseiva ISC2-CC curriculum — https://courseiva.com/learn/isc2-cc/risk-management-and-security-controls

**Official objective:** 1.4 — Explain risk management concepts and types of security controls (administrative, technical, physical).

## Introduction

Risk management and security controls. Without them, organisations are flying blind — spending money on the wrong defences while leaving the most dangerous vulnerabilities wide open. For the CC exam, you need to know how professionals identify threats, calculate their potential damage, and decide which controls to deploy, because every single security decision in a real company starts with a risk calculation.

## The House Fire Insurance Analogy

You own a house worth £300,000. You keep £50,000 in cash in a safe under your bed. Your front door lock is flimsy, and your smoke alarm hasn't worked in two years. Your neighbour lost everything in a kitchen fire last month. What do you do?

First, you assess the risk. You identify the threats — fire, burglary, flood. You determine the likelihood of each: the fire threat is high because of the dodgy wiring and missing alarm. The burglary threat is medium because the neighbourhood is quiet but the lock is weak. Then you calculate the potential impact: total loss of the house and cash — £350,000. That's the risk: the combination of likelihood and impact.

Next, you decide how to handle each risk. You could avoid the risk entirely by selling the house and living in a tent — that's risk avoidance. You could reduce the risk by installing a new smoke alarm and a deadbolt — that's risk mitigation. You could transfer the risk by buying home insurance so the insurance company pays if something happens — risk transfer. Or you could accept the risk and do nothing, hoping you're lucky — risk acceptance.

Finally, you put controls in place. The deadbolt is a physical control. The smoke alarm is a technical control. The insurance policy and your household rules about not leaving candles unattended are administrative controls. Each control type reduces either the likelihood or the impact of a specific threat.

Now translate that to IT: your company's data is the house. Threats are hackers, human errors, natural disasters. Risk management is the process of identifying these threats, measuring them, and deciding what to do. Security controls are the deadbolts, alarms, and policies that protect the data. Every control fits into one of the three buckets: administrative (policies, training, procedures), technical (firewalls, encryption, antivirus), or physical (locks, guards, server room badges).

For the CC exam, you must be able to match a given control to its type and explain how risk management steps — identify, assess, treat, monitor — work in order. The analogy sticks because everyone understands house security. The exam uses the same logic: threats are real, impacts are costly, controls are your defences.

## Core explanation

Risk management is the process of identifying, analysing, and responding to risks that could harm an organisation. In IT, a risk is the possibility that a threat — like a hacker, a power outage, or a clumsy employee — will exploit a vulnerability, which is a weakness in a system. The core goal is to reduce risk to an acceptable level without wasting money or slowing down business.

The formal risk management process has several stages. First, identify the assets — what are you protecting? That could be customer databases, financial records, employee laptops, or the company website. Next, identify threats to those assets — hackers, ransomware, floods, insider mistakes. Then identify vulnerabilities — outdated software, no firewall, weak passwords, unlocked server rooms.

Once threats and vulnerabilities are mapped, you perform risk analysis. You estimate two things for each risk: likelihood (how probable is it?) and impact (how bad would the damage be?). Multiply them together to get the risk level. For example, a small company with no firewall has a high likelihood of being hacked and a high impact — customer data leaked, fines, reputational damage. That risk is critical. A company with a firewall, antivirus, and strong passwords facing the same hacker has a lower likelihood, so the risk is lower.

After analysis, you decide on a risk treatment strategy. There are four options:

- Risk avoidance: stop the activity that creates the risk. Example: a bank decides not to offer a new online-only account because the security costs outweigh the profit.
- Risk mitigation: reduce the likelihood or impact of the risk. This is the most common approach. You install a firewall, train employees, encrypt data.
- Risk transfer: shift the financial burden of a risk to someone else. You buy cyber insurance or outsource a system to a cloud provider who takes on some of the risk.
- Risk acceptance: acknowledge the risk and decide to live with it. You document it, monitor it, but do not spend money on controls because the cost of controls would exceed the potential damage.

Once you decide on treatment, you implement security controls. Controls are the specific safeguards that enforce your risk treatment decisions. Every control falls into exactly one of three categories:

- Administrative controls: policies, procedures, and training that guide human behaviour. Examples include security policies, background checks, security awareness training, incident response plans, and separation of duties (where no single person has complete control over a critical process). These are sometimes called 'soft controls' because they rely on people.
- Technical controls: hardware or software that enforces security automatically. Examples include firewalls, encryption, intrusion detection systems, antivirus software, multi-factor authentication (MFA), and access control lists (ACLs). These are 'hard controls' — they work without human intervention once configured.
- Physical controls: barriers that protect the physical environment. Examples include locks on doors, security guards, surveillance cameras, biometric scanners, server room air conditioning to prevent overheating, and fences around the building.

Why does this structure matter for the CC exam? Because they will describe a scenario — for instance, 'the company requires employees to use a badge to enter the server room' — and ask you to classify it. That is a physical control. If they say 'the company requires all employees to complete annual security training,' that is an administrative control. If they say 'the company uses a firewall to block unauthorised traffic,' that is a technical control.

It is also critical to understand that controls can be further classified by their function. Preventive controls stop incidents from happening — a lock prevents unauthorised entry. Detective controls discover incidents after they occur — a security camera records a break-in. Deterrent controls discourage attempted violations — a visible sign saying '24-hour video surveillance' deters theft. Corrective controls fix damage after an incident — restoring data from a backup. Compensating controls provide an alternative when a primary control is not feasible — for example, if the main security guard is sick, a temporary guard is assigned.

The CC exam expects you to recognise these functional types, but the primary classification is always administrative, technical, or physical. Memorise examples for each. In the real world, professionals use all three types together in a layered defence called 'defence in depth'. No single control is enough. You lock the door (physical), you use a firewall (technical), and you train employees not to hold the door open for strangers (administrative). Each layer compensates for weaknesses in the others.

## Real-world context

Imagine you work as a junior security analyst at a mid-sized online retailer called ShopNow. The company stores customer names, addresses, credit card numbers, and purchase history. One morning, the Head of Security calls a meeting and says, 'We need a full risk assessment by next Friday. A competitor just got hacked, and our board is nervous.'

Your first task is asset identification. You walk through the building and list everything valuable. The customer database on the main server — that's the crown jewel. The backup tapes in the IT closet. The laptops employees take home. The public-facing website. The payment processing system. Each asset gets a value: financial loss if stolen, regulatory fines if exposed, reputation damage.

Next, you identify threats and vulnerabilities. You interview the IT team. They tell you the customer database runs on a server that hasn't had a security patch in six months — that's a vulnerability. Hackers are known to exploit that specific operating system version — that's a threat. You also discover the server room door doesn't lock properly — physical vulnerability. The receptionist lets anyone into the building without checking ID — administrative vulnerability. Each vulnerability has at least one corresponding threat.

You then estimate likelihood and impact. The unpatched server: likelihood is high (publicly known exploit), impact is critical (50,000 customer records). You assign it a risk score of 9 out of 10. The server room door lock: likelihood is low (employees are mostly trustworthy), but impact is high (someone could steal the backup tapes). Risk score 4. The receptionist issue: likelihood is moderate, impact moderate for theft of laptops. Risk score 5.

Now the risk treatment decision. For the unpatched server, you cannot accept that risk — the board would fire everyone. You cannot avoid it because the server runs the business. You cannot easily transfer it — no insurance covers unpatched servers. So you choose mitigation: schedule a patch for tonight, implement a firewall rule to limit access, and turn on logging to detect suspicious activity. That reduces the likelihood from high to low, dropping the risk score to 2.

For the server room door, you decide to mitigate by ordering a new electronic lock that logs every entry. For the receptionist issue, you implement an administrative control: a policy requiring all visitors to sign in and be escorted, plus technical control: a badge reader on the main door.

Finally, you document everything in a risk register — a spreadsheet or database that lists each asset, threat, vulnerability, current control, risk score, treatment decision, and owner. The Head of Security reviews it monthly to see if new risks emerged or if existing controls are effective. This is continuous monitoring, because threats change constantly.

What did you actually do as an IT professional? You applied structured thinking to chaos. You used the risk management framework to justify every security spending decision. When someone asks 'why do we need a badge reader?' you point to the risk register: vulnerability identifier VR-03, risk score 4, mitigation cost £2,000. That is how real-world security operates — evidence-based, not gut-feeling.

## Exam focus

The CC exam loves testing risk management and security controls because they are foundational concepts that every other domain builds on. Expect at least 5 to 8 questions from this area, and they tend to follow predictable patterns.

First, classification questions. You will be given a scenario and asked to identify whether the described control is administrative, technical, or physical. The exam deliberately uses edge cases. Example: 'A company requires employees to use a smart card to access the data centre.' This is a physical control because the smart card operates a locked door. Even though the smart card contains electronics, the purpose is physical access restriction. Another trap: 'The company uses a firewall to block malicious traffic.' That is technical. 'The company has a policy that employees must change passwords every 90 days.' Administrative. Memorise the categories with clear examples.

Second, risk treatment questions. You will be given a risk scenario and asked to match it to the correct strategy — avoid, mitigate, transfer, accept. They love to test the nuance. For example: 'The company decides to outsource payroll processing to a third-party vendor to reduce the risk of internal fraud.' That is risk transfer, not mitigation, because the risk shifts to another party. Another common trap: 'The company decides not to store customer credit card data at all.' That is risk avoidance. 'The company accepts the risk of a minor data breach because the cost of controls exceeds the expected loss.' That is risk acceptance.

Third, functional control type questions. You must distinguish between preventive, detective, deterrent, corrective, and compensating controls. Example: 'Backups are an example of which type of control?' Corrective. 'A security guard is what type of control?' Deterrent and preventive. 'An alarm system that goes off when a door is forced is what type?' Detective. The exam may combine functional and category: 'A firewall is a preventive technical control.' Be ready to identify both.

Fourth, the risk management process sequence. The exam asks 'What is the first step in risk management?' The answer is always asset identification, not threat identification. You cannot assess risk until you know what you are protecting. Another common order question: 'After you identify risks, what do you do next?' Risk analysis (determine likelihood and impact), then risk treatment, then monitoring.

Traps to watch out for:

- The exam will try to confuse 'risk' with 'threat'. Risk is the combination of likelihood and impact. Threat is a potential cause of harm. They are not the same. A question might say 'Which of the following is an example of a risk?' and offer 'a hacker attempting a brute force attack.' That is a threat, not a risk. The risk is 'the probability and potential damage of the hacker succeeding.'
- They may ask about 'risk appetite' versus 'risk tolerance'. Risk appetite is the amount of risk an organisation is willing to take on overall. Risk tolerance is the acceptable deviation from that appetite for a specific asset. For the CC exam, you generally do not need deep detail, but know that risk appetite is broad and strategic, risk tolerance is narrow and tactical.
- Watch for 'residual risk' and 'inherent risk'. Inherent risk is the risk level before any controls are applied. Residual risk is what remains after controls are implemented. The exam might say 'After implementing a firewall, what type of risk remains?' Residual risk.
- Key definitions to memorise: asset, threat, vulnerability, risk, control, likelihood, impact, risk register, risk owner, safeguard, countermeasure, defence in depth, least privilege, separation of duties.

The exam will present these terms in multiple-choice questions where two answers sound correct. The correct one is the one that uses the exact terminology from the ISC2 Official Study Guide. If you memorise the definitions and examples above, you will get these questions right.

## Step by step

1. **Identify Assets** — List everything of value: data (customer records, financial reports), hardware (servers, laptops), software (applications, databases), and people (employees with access). Without this step, you are protecting nothing. The exam calls these 'information assets'.
2. **Identify Threats and Vulnerabilities** — For each asset, list what could harm it (threats) and what weaknesses make it vulnerable (vulnerabilities). A threat could be a hacker, a fire, a disgruntled employee. A vulnerability could be unpatched software, a weak password, an unlocked door. The exam stresses that a vulnerability without a threat is not a risk.
3. **Analyse Risk** — For each threat-vulnerability pair, estimate likelihood (probability of occurrence) and impact (financial, reputational, legal damage). Multiply them to get a risk score. The exam calls this 'risk assessment' and expects you to know that high likelihood + high impact = critical risk.
4. **Treat Risk** — Choose a treatment strategy for each risk: avoid, mitigate, transfer, or accept. Document the decision and assign an owner. The exam tests the difference between these four options in scenarios, especially transfer versus mitigate.
5. **Implement Controls and Monitor** — Deploy the selected controls — administrative, technical, physical — and continuously review the risk register for changes. New threats emerge, controls degrade, business priorities shift. Monitoring ensures the residual risk stays within the organisation's accepted levels. The exam emphasises that risk management is a cycle, not a one-off project.

## Comparisons

### Risk vs Threat

**Risk:**
- Combination of likelihood and impact of a potential harm
- Measured as a score or level (e.g., high, medium, low)
- The thing you try to reduce through controls

**Threat:**
- A potential cause of harm (e.g., hacker, fire, flood)
- Exists independently of any specific vulnerability
- The thing you identify during risk assessment

### Administrative Control vs Technical Control

**Administrative Control:**
- Policies, procedures, training, and guidelines
- Relies on human compliance for effectiveness
- Examples: security policy, background checks, separation of duties

**Technical Control:**
- Hardware or software that enforces security automatically
- Works without ongoing human intervention once configured
- Examples: firewall, encryption, antivirus, MFA

### Risk Mitigation vs Risk Transfer

**Risk Mitigation:**
- Reduces the likelihood or impact of a risk
- Organisation retains ownership of the risk
- Example: installing a firewall to reduce hacking risk

**Risk Transfer:**
- Shifts the financial burden of a risk to another party
- Organisation does not eliminate the risk but moves liability
- Example: buying cyber insurance or outsourcing payroll

### Preventive Control vs Detective Control

**Preventive Control:**
- Stops an incident from happening
- Active before an event occurs
- Example: lock on a door, firewall rule blocking malicious IPs

**Detective Control:**
- Discovers an incident after it has happened
- Passive until triggered by an event
- Example: intrusion detection system, security camera footage review

## Diagram

_The risk management lifecycle showing the sequence from asset identification through continuous monitoring, with the four treatment options branching from the analysis step._

```mermaid
flowchart TD
    A[Identify Assets] --> B[Identify Threats & Vulnerabilities]
    B --> C[Analyse Risk: Likelihood x Impact]
    C --> D[Decide Treatment Strategy]
    D --> E{Risk Treatment}
    E --> F[Risk Avoidance]
    E --> G[Risk Mitigation]
    E --> H[Risk Transfer]
    E --> I[Risk Acceptance]
    F --> J[Implement Controls]
    G --> J
    H --> J
    I --> J
    J --> K[Monitor Continuously]
    K --> B
```

## Common misconceptions

- **Misconception:** A firewall is both a technical and an administrative control because the company has a policy to configure it. **Reality:** A firewall is always a technical control. The policy that dictates how the firewall is configured is an administrative control, but the device itself is technical. (Beginners mix the policy with the product. The exam strictly separates the physical thing (firewall software/hardware) from the human process (policy).)
- **Misconception:** Risk management is only about preventing bad things from happening. **Reality:** Risk management also includes accepting risks when the cost of controls is higher than the potential loss, and transferring risks via insurance. (Media portrays security as pure prevention, so beginners think 'good security means no breaches ever'. Real security is about spending wisely, not about perfection.)
- **Misconception:** Physical controls are only relevant for large companies with data centres. **Reality:** Physical controls apply to any organisation with physical assets — a lock on a filing cabinet containing employee records is a physical control. (Beginners imagine data centres with biometric scanners and miss that a simple door lock is also a physical control. The exam tests this with everyday scenarios.)
- **Misconception:** Once a risk is mitigated, it is gone forever. **Reality:** Risk is dynamic. New threats emerge, existing controls degrade, and business changes can alter likelihood and impact. Continuous monitoring is required. (People think of security as a one-time fix, like installing an alarm. But in IT, threats evolve constantly — a patched vulnerability can be re-exploited if a new variant of malware appears.)
- **Misconception:** Separation of duties is a technical control because it is implemented in software. **Reality:** Separation of duties is an administrative control. It is a policy that defines how responsibilities are divided among people. Software may enforce it, but the policy is administrative. (When a control is enforced by software, beginners classify it as technical. But the underlying principle — dividing tasks to prevent fraud — is human and procedural.)

## Key takeaways

- Risk management follows a five-step process: identify assets, identify threats and vulnerabilities, analyse risk (likelihood + impact), treat risk (avoid, mitigate, transfer, accept), and monitor continuously.
- Every security control fits into exactly one of three categories: administrative (policies, training, procedures), technical (firewalls, encryption, antivirus), or physical (locks, guards, cameras).
- The four risk treatment options are avoid (stop the activity), mitigate (reduce likelihood or impact), transfer (shift financial burden via insurance or outsourcing), and accept (document and monitor without action).
- Preventive controls stop incidents before they happen, detective controls discover incidents after they occur, deterrent controls discourage attempts, corrective controls fix damage, and compensating controls provide an alternative when primary controls fail.
- Inherent risk is the risk level before any controls are applied; residual risk is what remains after controls are in place, and it must be accepted or further treated.
- Defence in depth uses multiple layers of different control types so that if one control fails, another still protects the asset.

## FAQ

**What is the difference between a threat and a vulnerability?**

A threat is a potential cause of harm — a hacker, a storm, a careless employee. A vulnerability is a weakness that a threat could exploit — like an open port, outdated software, or a missing lock. They are different: the threat exists whether or not the vulnerability does.

**Can a control be both administrative and technical?**

No. Every control belongs to exactly one primary category. The policy that requires password changes is administrative. The software that enforces it is technical. They work together, but the exam wants you to pick the category of the control itself, not its supporting elements.

**What is risk appetite?**

Risk appetite is the amount of risk an organisation is willing to accept in pursuit of its goals. A bank has low risk appetite; a startup might have high risk appetite. It is different from risk tolerance, which is the acceptable variation for a specific asset.

**Do I need to memorise all control types for the exam?**

Yes. Memorise the three primary categories (administrative, technical, physical) and the five functional types (preventive, detective, deterrent, corrective, compensating) with two real examples each. The exam will ask you to classify a control described in a short scenario.

**What is a risk register?**

A risk register is a document or tool that lists every identified risk, its likelihood and impact, the current controls, the treatment plan, the risk owner, and the status. It is the central record for the risk management process.

**Can risk be completely eliminated?**

No. There is always residual risk after controls are implemented. The goal is to reduce risk to an acceptable level, not to zero. Zero risk is impossible and would cost infinite money, which no organisation can afford.

## Check your understanding

1. **A company decides to install a sprinkler system in its server room. Which type of control is this — administrative, technical, or physical?**

   Answer: Physical control, because it is a physical device that protects the physical environment.

2. **What is the difference between inherent risk and residual risk?**

   Answer: Inherent risk is the risk level before any controls are applied. Residual risk is what remains after controls are implemented.

3. **An organisation chooses to accept a risk instead of spending £100,000 on controls for an asset worth £10,000. Which risk treatment strategy are they using?**

   Answer: Risk acceptance, because they have decided the cost of controls exceeds the potential loss.

4. **Which step of the risk management process comes immediately after identifying threats and vulnerabilities?**

   Answer: Analyse risk — determining the likelihood and impact of each threat-vulnerability pair to calculate the risk level.

5. **A policy requires two different employees to approve any financial transaction over £5,000. Is this an example of an administrative, technical, or physical control?**

   Answer: Administrative control, because it is a policy that defines human procedures and separation of duties.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/isc2-cc/risk-management-and-security-controls