CompTIA Security Plus: Section 9 Risk Management

Section 9: Risk Management Study Guide

4.3 Risk Management Processes and Concepts

Risk Terminology

• Risk = Threat × Vulnerability × Impact
• Threat, Vulnerability, Likelihood, Impact
• Risk Appetite vs. Risk Tolerance
• Residual Risk

Risk Assessment Types

• Qualitative: High/Med/Low, risk matrices
• Quantitative: ALE = SLE × ARO; SLE = Asset Value × Exposure Factor; ARO = frequency per year
• Hybrid: Combined qualitative and quantitative

Risk Assessment Steps

1. Identify: Assets, threats, vulnerabilities
2. Analyze: Determine likelihood and impact
3. Evaluate: Prioritize against risk criteria

Risk Treatment Options

• Accept: Monitor residual risk
• Avoid: Eliminate the risk source
• Mitigate: Apply controls to reduce likelihood/impact
• Transfer: Shift risk via insurance or outsourcing

Risk Register

• Columns: ID, Description, Likelihood, Impact, Score, Treatment, Owner, Status, Review Date
• Tracks identified risks and remediation status

Monitoring and Reporting

• Metrics: Number of risks accepted/mitigated/transferred, residual risk trends
• Dashboards/Heat Maps: Visualize likelihood vs. impact
• Review Frequency: Continuous for high-risk, periodic for others

4.1 Policies, Plans, and Procedures

• Policy: High-level management directive
• Standard: Mandatory actions to enforce policy
• Procedure: Step-by-step instructions
• Guideline: Recommended practices

Business Impact Analysis (BIA)

• RTO: Maximum acceptable downtime
• RPO: Maximum acceptable data loss
• MTPoD: Maximum tolerable period of disruption
• Criticality ranking of business functions

4.5 Frameworks and Concepts

• NIST RMF: Categorize, Select, Implement, Assess, Authorize, Monitor
• ISO 31000: Principles and guidelines for risk management
• FAIR: Quantitative risk analysis model
• Bow-Tie Analysis: Visual mapping of cause, event, impact and controls

Common Pitfalls

• Mixing qualitative and quantitative methods incorrectly
• Failing to track residual risk
• Confusing treatment options (accept, avoid, mitigate, transfer)
• Policy vs. procedure confusion

Sample Scenarios

Scenario	Objective	Response
Calculate ALE for $50k asset, 40% EF, ARO=2	Quantitative Assessment	SLE=20k, ALE=40k
Transfer risk via SLA after vendor breach	Risk Transfer	SLA with breach notification clause
Risk register missing owner/status	Risk Register	Add Owner, Status, Review Date columns
Appetite 15%, Tolerance 5%	Risk Appetite/Tolerance	Accept ≤5%, Monitor up to 15%, Mitigate >15%
Which document defines step-by-step assessment?	Policy vs. Procedure	Risk Assessment Procedure

Exam-Focus Study Techniques

• Flashcards by objective (e.g., ALE formula, residual risk definition, NIST RMF steps)
• Mini risk register exercise
• Heat map plotting for hypothetical risks
• Risk management process flowchart
• Framework comparison table (NIST RMF, ISO 31000, FAIR)
• Topic audits for practice errors