Unit 01 of 03
Risk Management
Ranking the defenses measured one by one by nine courses on the same list: producing a risk list from asset, threat and impact items, how qualitative scoring and monetary modeling rank the same list differently, the risk reduced per unit by mitigation, transfer, acceptance and avoidance in the same budget, the item missing from the inventory that can enter no ranking, and the control delegated to a supplier but not verifiable.
Published Updated
Lessons
- 01 Risk Assessment Process The course's unit of measure is established: 70 pairs of ten assets and seven threats produce 47 risk items, a total annual risk of 5,768.61 fictional units is distributed across the asset classes, the 300-count class holds a 7.2 percent share while the three-count class reaches 17.9 percent, and ranking by decrease per unit of effort changes the position of 45 items in the same list and reduces 240.00 more units of risk on a 200-unit budget. 14 min read
- 02 Qualitative and Quantitative Approaches The same 47 items are run through two scales: the monetary model computes single and annualized loss expectancy in fictional units, while the five-by-five qualitative matrix reduces the items to three levels, ties 479 of the 1,081 item pairs and reverses 52 of them, writes the 184.80-unit item as medium and the 96.00-unit item as high, and opens a 745.20-unit gap in the outcome of the same ten items chosen with the same effort. 15 min read
- 03 Risk Treatment Options Mitigation, transfer, acceptance and avoidance are all run under the same annual budget of 300 units: mitigation reduces risk by 2,746.71 units with 22 decisions while transfer and avoidance stay at 243.00 and 656.04 units, the transfer agreement takes over 76 of 235 component items and leaves 3,507.70 units outside, avoidance is an asset-level decision so it can never enter the ranking even under a 1,200-unit budget, and 1,699.81 of the 3,021.90 accepted units come from 25 items that were never opened. 14 min read
- 04 Asset and Inventory Management When six off-inventory assets are added to the list, the 47-item list grows to 69 items and the 5,768.61-unit total rises to 8,045.45 fictional units: off-inventory items carry 28.3 percent of the true risk, 41 recorded items change rank, the largest shift is 22 positions, six shadow items enter the top twenty, 8 of the 30 shadow items can never enter any ranking because their value was never written, and the shadow item that rises to the highest rank comes from an asset no discovery source has ever seen. 13 min read
- 05 Third-Party Risk Across three suppliers, 3 of the 16 controls written into the contract are never asked about in the survey, 6 are answered but not verified, and only 7 are verified by evidence: the 9 controls that appear delegated but cannot be verified carry 555.10 fictional units, 25.4 percent of supplier risk; when the 62-item program list is ranked by evidence instead of declaration, 51 items change position and the number of supplier items in the top ten rises from one to three. 14 min read