2.3 Risk Evaluation & Risk Treatment Methodology

2.3 Risk Evaluation & Risk Treatment Methodology

Once information security risks are identified and analyzed, the organization must evaluate them to determine where treatment is required. Risk evaluation compares analyzed risk scores against the organization's risk acceptance criteria established under Clause 6.1.2. Risks exceeding acceptable thresholds must undergo risk treatment—the process of selecting and implementing measures to modify risk levels.

---

1. Quantitative vs. Qualitative Risk Evaluation

Risk evaluation methodologies fall into two primary categories: qualitative and quantitative. Lead Implementers must understand when and how to apply each method.

Qualitative Risk Evaluation

Qualitative evaluation relies on descriptive scales (e.g., Low, Medium, High, Critical) and expert judgment. It is rapid, cost-effective, and ideal for evaluating general operational, administrative, and physical security risks across the enterprise.

Quantitative Risk Evaluation

Quantitative evaluation calculates precise financial values using mathematical modeling. It is applied to high-impact financial or technology assets where empirical historical loss data is available.

Key Quantitative Formulas

1. Asset Value (AV): Total replacement, operational, and regulatory value of the information asset.
2. Exposure Factor (EF): The percentage loss that a specific threat would cause to the asset ($0.0 \text{ to } 1.0$).
3. Single Loss Expectancy (SLE): $\text{SLE} = \text{Asset Value (AV)} \times \text{Exposure Factor (EF)}$
4. Annual Rate of Occurrence (ARO): The estimated frequency with which a threat is expected to occur in a single year.
5. Annualized Loss Expectancy (ALE): $\text{ALE} = \text{Single Loss Expectancy (SLE)} \times \text{Annual Rate of Occurrence (ARO)}$

---

2. The Four ISO 27001 Risk Treatment Options

ISO/IEC 27001:2022 Clause 6.1.3 requires the organization to formulate a risk treatment plan by selecting appropriate treatment options. There are four standard options recognized under ISO 27005:

                      +---------------------------------+
                      |    IDENTIFIED UNACCEPTABLE RISK  |
                      +---------------------------------+
                                       |
       +--------------------+----------+----------+--------------------+
       |                    |                     |                    |
       v                    v                     v                    v
+--------------+    +---------------+     +---------------+    +---------------+
| 1. MITIGATE  |    |  2. AVOID     |     |   3. TRANSFER |    |   4. ACCEPT   |
| (Modify Risk |    | (Eliminate    |     | (Share Risk   |    | (Retain Risk  |
| via Controls)|    |  Activity)    |     |  via Ins/3P)  |    |  W/ Approval) |
+--------------+    +---------------+     +---------------+    +---------------+

1. Risk Modification / Mitigation (Applying Controls)

Deploying administrative, technical, physical, or organizational controls to reduce threat likelihood, vulnerability exposure, or impact. Example: Implementing Multi-Factor Authentication (MFA) and Endpoint Detection and Response (EDR) agents to mitigate credential theft and malware risks.

2. Risk Avoidance (Eliminating the Activity)

Deciding not to start or maintain an activity, asset, or process that gives rise to the risk. Example: Decommissioning a legacy, unpatchable customer database application rather than keeping it exposed to the public internet.

3. Risk Sharing / Transfer (Distributing Impact)

Sharing or transferring financial or operational risk consequences to a qualified third party. Example: Purchasing cyber liability insurance or executing Service Level Agreements (SLAs) with cloud vendors that include financial indemnification clauses.

4. Risk Retention / Acceptance (Absorbing the Risk)

Retaining the risk without further treatment, provided it falls within defined risk acceptance criteria or treatment costs exceed potential loss. Example: Accepting the minor risk of temporary internet latency at a remote regional office without purchasing a secondary redundant fiber line.

---

3. Real-World Risk Treatment Scenarios & Control Selection

To master Lead Implementer decision-making, evaluate the following real-world scenario applications:

Scenario A: Unencrypted Legacy Operational System
- Risk: Legacy medical billing system cannot support modern database encryption without breaking application code.
- Treatment Selected: Risk Modification (Mitigation via compensatory controls) + Risk Retention.
- Action: Network segmentation, strict IP whitelisting, database firewall monitoring, and formal Risk Owner sign-off.

Scenario B: High-Risk Third-Party Software Development
- Risk: Outsourcing core banking software development to an unvetted offshore software vendor.
- Treatment Selected: Risk Avoidance.
- Action: Canceling the offshore project contract; bringing software development in-house under ISO 27001 secure coding guidelines.

---

4. Residual Risk Acceptance & Governance Sign-Off (Clause 6.1.3 e)

Residual Risk is the risk remaining after risk treatment controls have been selected and implemented.

$\text{Residual Risk} = \text{Inherent Risk} - \text{Impact of Implemented Controls}$

Governance Requirements under Clause 6.1.3 e)

ISO/IEC 27001:2022 Clause 6.1.3 e) explicitly mandates that Risk Owners must formally approve the risk treatment plan and accept the residual information security risks.

+-----------------------------------------------------------------------------+
|                   RESIDUAL RISK ACCEPTANCE WORKFLOW                         |
+-----------------------------------------------------------------------------+
| [Inherent Risk Evaluated] --> [Controls Selected] --> [Residual Risk Defined] |
|                                                                    |        |
| [RTP Executed & Verified] <-- [Formal Risk Owner Sign-Off] <-------+        |
+-----------------------------------------------------------------------------+

• No Automatic Acceptance: Residual risk can never be accepted implicitly or by default; it requires written, documented sign-off.
• Unacceptable Residual Risk: If residual risk exceeds organizational risk criteria, additional controls must be applied, or top management must formally grant a temporary risk exception with strict compensating requirements.

---

5. PECB Lead Implementer Exam Notes & Calculation Mastery

• Quantitative ALE Math: Memorize $\text{SLE} = \text{AV} \times \text{EF}$ and $\text{ALE} = \text{SLE} \times \text{ARO}$. On the exam, if an asset is worth $500,000, EF is 40% (0.40), and ARO is 0.25 (once every 4 years), SLE is $200,000 and ALE is $50,000.
• Identifying Treatment Types: If an organization stops performing an activity, it is Risk Avoidance. If it buys insurance, it is Risk Transfer. If it installs a firewall, it is Risk Modification. If it decides the risk is within budget tolerance and does nothing extra, it is Risk Retention.
• Clause 6.1.3 e Sign-Off: Certification auditors will issue a major non-conformity if residual risk acceptance is signed by a consultant or CISO rather than the designated operational Risk Owner.