What is risk management in Security+?
D1 · General · CompTIA Security+ SY0-701Risk management is the systematic process of identifying, assessing, prioritizing, and addressing risks to an organization's information assets and operations.
Risk management process: identify risks → assess/analyze (likelihood × impact) → prioritize → respond → monitor.
Risk response strategies:
🛡️ Mitigate/Reduce — implement controls to reduce likelihood or impact
🔄 Transfer — shift risk to another party (cyber insurance)
❌ Avoid — eliminate the activity that creates the risk
✅ Accept — acknowledge and accept the risk (residual risk)
Risk management process: identify risks → assess/analyze (likelihood × impact) → prioritize → respond → monitor.
Risk response strategies:
🛡️ Mitigate/Reduce — implement controls to reduce likelihood or impact
🔄 Transfer — shift risk to another party (cyber insurance)
❌ Avoid — eliminate the activity that creates the risk
✅ Accept — acknowledge and accept the risk (residual risk)
Know the four risk response strategies: Avoid, Transfer, Mitigate, Accept (ATMA). Residual risk = remaining risk after controls. Inherent risk = risk before any controls. Risk appetite = how much risk the organization is willing to accept. Risk tolerance = the acceptable variance around risk appetite.