Overview

# Risk Management

Risk identification, assessment, treatment and monitoring across the

organization. This subcategory covers the process of turning

uncertainty into quantified, prioritized and owned decisions.

Writeups available in three languages are not applicable here: this is

reference material, not a walkthrough.

## Files

| # | File | Format |

|---|------|--------|

| 01 | Risk Management Fundamentals | Process-based |

| 02 | Risk Assessment Methodologies | Process-based |

| 03 | Risk Treatment and Response | Process-based |

| 04 | Third-Party and Supply Chain Risk | Process-based |

| 05 | Risk Monitoring and Reporting | Process-based |

## Certification Alignment

This subcategory maps to the following certifications:

- **CISSP** - Domain 1 (Security and Risk Management)

- **CISM** - Domain 2 (Information Risk Management)

- **CRISC** - Domain 1 (Governance), Domain 2 (IT Risk Assessment),

Domain 3 (Risk Response and Reporting)

See ../../CERTIFICATIONS.md for the full matrix.

## Related

• 01 Governance and Frameworks

• 03 Compliance and Regulation (planned subcategory)

## References

- NIST SP 800-30 Rev. 1 - Guide for Conducting Risk Assessments - https://csrc.nist.gov/pubs/sp/800/30/r1/final

- ISO 31000:2018 - Risk Management Guidelines - https://www.iso.org/standard/65694.html

- FAIR Institute - Factor Analysis of Information Risk - https://www.fairinstitute.org/