Risk Management Processes
Key Takeaways
Subdomain 1.2 names the risk management lifecycle and risk management processes.
Risk management identifies risks, assesses them, decides how to treat them, and monitors the result.
A risk assessment supports a decision; it does not predict an exact outcome.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 1.2, checked 2026-10-22.
The Lifecycle in Plain Terms
Subdomain 1.2 names the risk management lifecycle and the risk management processes. The outline does not give a formula, so study the lifecycle as a loop: identify the risk, assess how serious it is, decide what to do about it, and then monitor whether the decision is still working.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 1.2, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Using the Lifecycle in Scenarios
When a scenario asks for the next step, find the stage it is in. An unidentified asset cannot be assessed. An assessed risk still needs a decision. A decision that was made but not monitored may no longer fit the environment. Choose the answer that moves the process forward at the stage the scenario describes.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 1.2: Risk management lifecycle
- 1.2: Risk management processes
Common Traps
A common trap is treating a risk decision as finished once it is written. The lifecycle continues: a decision must still be monitored, and a risk that changes needs a new assessment.
A team has listed its assets and threats but has not yet decided what to do about any risk. Which lifecycle stage comes next?
Deciding how to treat the assessed risks
Closing the risk register permanently once the assessment is finished, so that no later review is needed
Replacing every asset in the inventory before any risk has been assessed or reviewed by the owners
Deleting the threat list so that only the assets remain in the register for the next review cycle
Sections you finish are checked off in the contents.