From the course: ISACA Certified in Risk and Information Systems Control (CRISC) Cert Prep

Unlock this course with a free trial

Join today to access over 25,300 courses taught by industry experts.

Risk ranking

Risk ranking

From the course: ISACA Certified in Risk and Information Systems Control (CRISC) Cert Prep

Start my 1-month free trial Buy for my team

Risk ranking

“

- One of the most important things that we'll do once we identify all the risk, once we put some stories behind it, figure out who the threats are, figure out where our vulnerabilities might be, is ranking our risks. So how do we want to rank risk to ensure that we are appropriately treating it? This is combining everything that we know about the risk. What's the level associated with the threat? What are the characteristics, the severity of the vulnerabilities, the likelihood of success of taking advantage of those vulnerabilities? What's the impact of a successful event, et cetera, and how are we literally ranking those things against each other to make sure that we have a 1 to N list of all of our risks? It's possible that our risk ranking system might have different categories. So oftentimes you'll see people will say, well, we have critical risks and high risks and medium risks and low risks. Incredibly helpful…

Contents