Risk assessment
Estimate plausible harm in context and explain the assumptions.
The idea
Risk assessment identifies what needs protecting, relevant threats and weaknesses, possible events, and their consequences. Likelihood and impact may be evaluated qualitatively or quantitatively, but the method should be explicit and suitable for the decision. Record uncertainty and existing controls. Prioritization should consider actual exposure and business importance rather than treating every technical weakness as equally urgent. Assessments need updating as systems or threats change.
In practice
A booking service’s outage risk is assessed using its exposure, failure modes, existing recovery arrangements, and the effect on customers and revenue.
A common misunderstanding
A colored matrix is not the assessment itself. Without defined scales and evidence, its precision can be misleading.
Check your understanding
What should an assessment explain?
Think it through: The scenario, affected assets, assumptions, existing controls, likelihood and impact reasoning, and uncertainty.
Build a plausible harm scenario
A risk assessment connects a threat, a vulnerable condition, an affected asset or activity, and a consequence. Start with a concrete scenario rather than a broad label such as ransomware risk. For example, compromised administrator access could allow deletion of a business application's recovery data, extending an outage. This wording makes both the exposure and possible response easier to examine.
Likelihood and impact estimates depend on assumptions and evidence. Consider exposure, relevant threat activity, existing protections, dependencies, and the organization's ability to recover. A numerical score is a communication tool, not a measured physical quantity. Two risks with the same score can involve very different uncertainty and consequences.
A fictional remote-access review
An academy assesses a legacy remote-access service used by a small administrative team. The team confirms who can reach it, how accounts authenticate, what access follows a successful login, and how misuse would be detected. It then considers business harm if the service is compromised or unavailable. The assessment does not stop at the existence of an old version number.
Where evidence is weak, record the uncertainty and identify a useful information-gathering step. A configuration review or recovery exercise may improve the assessment more than debating a score. Reassess after material changes because a new dependency or control failure can alter the scenario.
Compare two explanations
Write a fictional risk statement for a shared administrator account. Then rewrite it to identify the affected service, misuse path, and business consequence. Add one existing protection and one uncertainty. Ask whether another person could use the statement to choose a response. If it only names a technology, it probably needs more context before it supports a meaningful decision.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
NIST: Guide for Conducting Risk Assessments