Risk Management

SLE, ARO and ALE

Evidence: Mixed

Revision: Available · 3 questions · 2 flashcards

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• ALE equals SLE multiplied by ARO; £20,000 times 0.25 is £5,000 expected annualised loss, not a guaranteed annual payment; ARO is an expected yearly frequency.

• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Risk — Supplementary Study Guide explanation

Recorded evidence

• ALE equals SLE multiplied by ARO; £20,000 times 0.25 is £5,000 expected annualised loss, not a guaranteed annual payment; ARO is an expected yearly frequency.

• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Risk — Supplementary Study Guide explanation · Assets, threats, vulnerabilities and business context; Qualitative and quantitative assessment; Technical severity and business risk; Annualised Loss Expectancy; Business Impact Analysis; Measurement and lifecycle; Risk treatment options; Inherent and residual risk; Risk appetite and risk tolerance

Reviewed 2026-09-22. Reviewed against approved Sessions 3–4 learning and Core Concepts explanations. Fictional applications are educational elaborations, not completed practical work. Learning-only; this concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Business Impact Analysis

Evidence: Mixed

Revision: Available · 1 question · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• BIA identifies important activities, dependencies and disruption consequences over time; it is distinct from vulnerability scoring and does not alone establish likelihood.

• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Risk — Supplementary Study Guide explanation

Recorded evidence

• BIA identifies important activities, dependencies and disruption consequences over time; it is distinct from vulnerability scoring and does not alone establish likelihood.

• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Risk — Supplementary Study Guide explanation · Assets, threats, vulnerabilities and business context; Qualitative and quantitative assessment; Technical severity and business risk; Annualised Loss Expectancy; Business Impact Analysis; Measurement and lifecycle; Risk treatment options; Inherent and residual risk; Risk appetite and risk tolerance

Reviewed 2026-09-22. Reviewed against approved Sessions 3–4 learning and Core Concepts explanations. Fictional applications are educational elaborations, not completed practical work. Learning-only; this concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

CVSS and business risk

Evidence: Mixed

Revision: Available · 1 question · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• The same CVSS base severity can have different business risk because exposure, information sensitivity, dependencies, consequences and effective controls differ.

• Session 3: Governance, Risk and Compliance — Classroom session record
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Risk — Supplementary Study Guide explanation

Recorded evidence

• The same CVSS base severity can have different business risk because exposure, information sensitivity, dependencies, consequences and effective controls differ.

• Session 3: Governance, Risk and Compliance — Classroom session record · Governance and Accountability; Risk and Measurement; Risk Management Lifecycle; Risk Treatment; Compliance Is Not the Same as Security; Risk Appetite vs Risk Tolerance; CVSS and Business Risk; ISO/IEC 27001 and 27002; Cyber Essentials; NIST Cybersecurity Framework; UK GDPR and Data Protection; Data Classification; UK GDPR Lawful Bases; ICO and the 72-Hour Rule; PCI DSS
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Risk — Supplementary Study Guide explanation · Assets, threats, vulnerabilities and business context; Qualitative and quantitative assessment; Technical severity and business risk; Annualised Loss Expectancy; Business Impact Analysis; Measurement and lifecycle; Risk treatment options; Inherent and residual risk; Risk appetite and risk tolerance

Reviewed 2026-09-22. Reviewed against approved Sessions 3–4 learning and Core Concepts explanations. Fictional applications are educational elaborations, not completed practical work. Learning-only; this concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Inherent and residual risk

Evidence: Mixed

Revision: Available · 1 question · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Inherent risk precedes the controls being evaluated; residual risk considers their demonstrated effectiveness, not installation alone, and requires reassessment.

• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Risk — Supplementary Study Guide explanation

Recorded evidence

• Inherent risk precedes the controls being evaluated; residual risk considers their demonstrated effectiveness, not installation alone, and requires reassessment.

• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Risk — Supplementary Study Guide explanation · Assets, threats, vulnerabilities and business context; Qualitative and quantitative assessment; Technical severity and business risk; Annualised Loss Expectancy; Business Impact Analysis; Measurement and lifecycle; Risk treatment options; Inherent and residual risk; Risk appetite and risk tolerance

Reviewed 2026-09-22. Reviewed against approved Sessions 3–4 learning and Core Concepts explanations. Fictional applications are educational elaborations, not completed practical work. Learning-only; this concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Risk appetite, tolerance and capacity

Evidence: Mixed

Revision: Available · 2 questions · 2 flashcards

Exam relevance

• Security+ · 5.2 · direct

  This concept relates to the cited objective. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 0 of 2 questions and 0 of 2 flashcards. The mapping does not verify the others.

Reviewed revision scope

• Risk appetite is how much risk an organisation is willing to accept in pursuit of its objectives.
• Risk tolerance is the threshold beyond which action or escalation becomes necessary.
• Risk capacity is the maximum loss an organisation can withstand; appetite is willingness and tolerance sets acceptable limits or escalation thresholds, including the one-hour disruption example.

• Session 3: Governance, Risk and Compliance — Classroom session record
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Risk — Supplementary Study Guide explanation

Recorded evidence

• Risk appetite is how much risk an organisation is willing to accept in pursuit of its objectives.
• Risk tolerance is the threshold beyond which action or escalation becomes necessary.
• Risk capacity is the maximum loss an organisation can withstand; appetite is willingness and tolerance sets acceptable limits or escalation thresholds, including the one-hour disruption example.

• Session 3: Governance, Risk and Compliance — Classroom session record · Governance and Accountability; Risk and Measurement; Risk Management Lifecycle; Risk Treatment; Compliance Is Not the Same as Security; Risk Appetite vs Risk Tolerance; CVSS and Business Risk; ISO/IEC 27001 and 27002; Cyber Essentials; NIST Cybersecurity Framework; UK GDPR and Data Protection; Data Classification; UK GDPR Lawful Bases; ICO and the 72-Hour Rule; PCI DSS
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Risk — Supplementary Study Guide explanation · Assets, threats, vulnerabilities and business context; Qualitative and quantitative assessment; Technical severity and business risk; Annualised Loss Expectancy; Business Impact Analysis; Measurement and lifecycle; Risk treatment options; Inherent and residual risk; Risk appetite and risk tolerance

Reviewed 2026-09-22. Reviewed against approved Sessions 3–4 learning and Core Concepts explanations. Fictional applications are educational elaborations, not completed practical work. Learning-only; this concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Risk assessment methods

Evidence: Mixed

Revision: Available · 2 questions · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Qualitative categories and ordinal matrix scores prioritise judgement; quantitative estimates use meaningful units, assumptions and uncertainty; ordinal products are not measured probabilities or loss ratios.

• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Risk — Supplementary Study Guide explanation

Recorded evidence

• Qualitative categories and ordinal matrix scores prioritise judgement; quantitative estimates use meaningful units, assumptions and uncertainty; ordinal products are not measured probabilities or loss ratios.

• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Risk — Supplementary Study Guide explanation · Assets, threats, vulnerabilities and business context; Qualitative and quantitative assessment; Technical severity and business risk; Annualised Loss Expectancy; Business Impact Analysis; Measurement and lifecycle; Risk treatment options; Inherent and residual risk; Risk appetite and risk tolerance

Reviewed 2026-09-22. Reviewed against approved Sessions 3–4 learning and Core Concepts explanations. Fictional applications are educational elaborations, not completed practical work. Learning-only; this concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Risk Fundamentals and Classroom Risk Models

Evidence: Mixed

Revision: Available · 3 questions · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Classroom (Session 4): an asset is something of value, a vulnerability is a weakness and a threat is a potential cause of an unwanted incident that may exploit a vulnerability.
• Classroom (Sessions 3 and 4): Risk = Impact × Likelihood, where impact is how serious the consequences would be and likelihood is how probable the event is over a stated period; high impact alone does not make a high risk.
• Classroom (Session 2): Risk = Threat × Vulnerability × Asset and Cyber Risk = Impact × Probability, and the same vulnerability does not carry the same risk in every situation.
• Supplementary: the classroom models are conceptual, not interchangeable quantitative equations; numbers are multiplied only in a defined rating scheme or a model with real units.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record
• Session 3: Governance, Risk and Compliance — Classroom session record
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Risk — Supplementary Study Guide explanation
• Risk — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 4): an asset is something of value, a vulnerability is a weakness and a threat is a potential cause of an unwanted incident that may exploit a vulnerability.
• Classroom (Sessions 3 and 4): Risk = Impact × Likelihood, where impact is how serious the consequences would be and likelihood is how probable the event is over a stated period; high impact alone does not make a high risk.
• Classroom (Session 2): Risk = Threat × Vulnerability × Asset and Cyber Risk = Impact × Probability, and the same vulnerability does not carry the same risk in every situation.
• Supplementary: the classroom models are conceptual, not interchangeable quantitative equations; numbers are multiplied only in a defined rating scheme or a model with real units.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record · The CIA Triad; The DAD Triad; Securing Devices; Denial; DDoS Mitigation; Security, Usability and Functionality; Policies, Standards, Procedures and Guidelines
• Session 3: Governance, Risk and Compliance — Classroom session record · Governance and Accountability; Risk and Measurement; Risk Management Lifecycle; Risk Treatment; Compliance Is Not the Same as Security; Risk Appetite vs Risk Tolerance; CVSS and Business Risk; ISO/IEC 27001 and 27002; Cyber Essentials; NIST Cybersecurity Framework; UK GDPR and Data Protection; Data Classification; UK GDPR Lawful Bases; ICO and the 72-Hour Rule; PCI DSS
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Risk — Supplementary Study Guide explanation · Assets, threats, vulnerabilities and business context; Qualitative and quantitative assessment; Technical severity and business risk; Annualised Loss Expectancy; Business Impact Analysis; Measurement and lifecycle; Risk treatment options; Inherent and residual risk; Risk appetite and risk tolerance
• Risk — Supplementary Study Guide explanation · Three risk models; Four distinctions that are easy to blur; Vulnerabilities and dependencies

Reviewed 2026-09-24. Reviewed against the linked Learning Log entries and Study Guide lesson Sources and scope sections. Scope statements are labelled Classroom, Study Buddy or Supplementary. No practical competence, completed assessment or exam alignment is implied.

Risk lifecycle and treatment

Evidence: Mixed

Revision: Available · 5 questions · 2 flashcards

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Identify, analyse, evaluate, treat, monitor and review risks; Treat mitigates, Transfer shifts specified consequences, Tolerate accepts with authority, and Terminate avoids the activity; transfer does not remove vulnerability or accountability.

• Session 3: Governance, Risk and Compliance — Classroom session record
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record
• Risk — Supplementary Study Guide explanation

Recorded evidence

• Identify, analyse, evaluate, treat, monitor and review risks; Treat mitigates, Transfer shifts specified consequences, Tolerate accepts with authority, and Terminate avoids the activity; transfer does not remove vulnerability or accountability.

• Session 3: Governance, Risk and Compliance — Classroom session record · Governance and Accountability; Risk and Measurement; Risk Management Lifecycle; Risk Treatment; Compliance Is Not the Same as Security; Risk Appetite vs Risk Tolerance; CVSS and Business Risk; ISO/IEC 27001 and 27002; Cyber Essentials; NIST Cybersecurity Framework; UK GDPR and Data Protection; Data Classification; UK GDPR Lawful Bases; ICO and the 72-Hour Rule; PCI DSS
• Session 4: Governance, Risk and Compliance — In Depth — Classroom session record · The Three GRC Pillars; Compliance ≠ Security; ISO/IEC 27001 and Continual Improvement; Why Consultants Need Business Context; Business Impact Analysis; Assessing Risk; Identifying and Managing Risk; Frameworks and Standards; UK GDPR and Data Protection; Data Classification and Handling
• Risk — Supplementary Study Guide explanation · Assets, threats, vulnerabilities and business context; Qualitative and quantitative assessment; Technical severity and business risk; Annualised Loss Expectancy; Business Impact Analysis; Measurement and lifecycle; Risk treatment options; Inherent and residual risk; Risk appetite and risk tolerance

Reviewed 2026-09-22. Reviewed against approved Sessions 3–4 learning and Core Concepts explanations. Fictional applications are educational elaborations, not completed practical work. Learning-only; this concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Risk Owners and Risk Registers

Evidence: Partial

Revision: Available · 2 questions · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Classroom (Session 3): risk registers were named as a topic for further study, not taught in detail.
• Supplementary: a risk owner is a person with the authority and accountability to manage a risk and accept what remains; a risk register records each identified risk with its assessment, treatment, owner and review date.
• Supplementary: a register makes treatment decisions visible and checkable; an acceptance without a named owner, a recorded reason and a review date has usually just been ignored, and a residual rating above what an owner may accept goes to someone with the authority to accept it.

• Session 3: Governance, Risk and Compliance — Classroom session record
• Treating Risk — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 3): risk registers were named as a topic for further study, not taught in detail.
• Supplementary: a risk owner is a person with the authority and accountability to manage a risk and accept what remains; a risk register records each identified risk with its assessment, treatment, owner and review date.
• Supplementary: a register makes treatment decisions visible and checkable; an acceptance without a named owner, a recorded reason and a review date has usually just been ignored, and a residual rating above what an owner may accept goes to someone with the authority to accept it.

• Session 3: Governance, Risk and Compliance — Classroom session record · Governance and Accountability; Risk and Measurement; Risk Management Lifecycle; Risk Treatment; Compliance Is Not the Same as Security; Risk Appetite vs Risk Tolerance; CVSS and Business Risk; ISO/IEC 27001 and 27002; Cyber Essentials; NIST Cybersecurity Framework; UK GDPR and Data Protection; Data Classification; UK GDPR Lawful Bases; ICO and the 72-Hour Rule; PCI DSS
• Treating Risk — Supplementary Study Guide explanation · Recording the decision

Reviewed 2026-09-24. Reviewed against the linked Learning Log entries and Study Guide lesson Sources and scope sections. Scope statements are labelled Classroom, Study Buddy or Supplementary. No practical competence, completed assessment or exam alignment is implied.

Formal risk registers

Evidence: Not yet recorded

Revision material not yet added · 0 questions · 0 flashcards

Exam relevance

• Security+ · 5.2 · direct

  This concept relates to the cited objective. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 0 of 0 questions and 0 of 0 flashcards. The mapping does not verify the others.

Reviewed revision scope

Revision scope has not yet been authored and reviewed.

Recorded evidence

Not yet recorded in classroom, Study Buddy or Study Guide learning. This does not prevent revision.

Reviewed 2026-09-16. Reviewed against the linked repository learning record. Scope is introductory; no practical competence or complete objective coverage is implied.

Third-Party and Supply-Chain Risk

Evidence: Mixed

Revision: Available · 5 questions · 1 flashcard

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Classroom (Session 2): organisations can inherit cybersecurity risk through third-party suppliers, services and software, and a supplier or dependency weakness can create an attack path even when the organisation protects its own systems.
• Classroom (Session 2): the British Airways Magecart incident illustrated how malicious JavaScript can interfere with web pages and capture information that users enter.
• Supplementary: supplier risk is managed across identification, proportionate assessment, contract, monitoring and exit; a certificate is evidence only for its scope, and using a supplier does not transfer accountability.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record
• Third-Party and Supply-Chain Risk — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 2): organisations can inherit cybersecurity risk through third-party suppliers, services and software, and a supplier or dependency weakness can create an attack path even when the organisation protects its own systems.
• Classroom (Session 2): the British Airways Magecart incident illustrated how malicious JavaScript can interfere with web pages and capture information that users enter.
• Supplementary: supplier risk is managed across identification, proportionate assessment, contract, monitoring and exit; a certificate is evidence only for its scope, and using a supplier does not transfer accountability.

• Session 2: Cyber Fundamentals Part 2 — Classroom session record · The CIA Triad; The DAD Triad; Securing Devices; Denial; DDoS Mitigation; Security, Usability and Functionality; Policies, Standards, Procedures and Guidelines
• Third-Party and Supply-Chain Risk — Supplementary Study Guide explanation · Inheriting risk from others; Example: British Airways and Magecart; Managing supplier risk across the relationship; Accountability stays with the organisation

Reviewed 2026-09-24. Reviewed against the linked Learning Log entries and Study Guide lesson Sources and scope sections. Scope statements are labelled Classroom, Study Buddy or Supplementary. No practical competence, completed assessment or exam alignment is implied.