Risk Analysis
- •
def
- •
evaluating identified risks, either qualitatively or quantitatively
- •
- •
qualitative risk assessment
- •
gathers opinions on significance, often displayed visually (e.g., a traffic-light grid)
- •
- •
quantitative risk assessment
- •
ARO (Annualized Rate of Occurrence) — how likely is the event to occur in a given year?
- •
asset value (AV) — the value of the asset to the organization
- •
exposure factor (EF) — the percentage of the asset's value lost in an incident (0.25 = a quarter lost, 1.0 = total loss)
- •
SLE (Single Loss Expectancy) = AV × EF — the monetary loss from a single event
- •
ALE (Annualized Loss Expectancy) = ARO × SLE — the expected yearly loss
- •
- •
impact dimensions
- •
life, property, safety, finance, reputation
- •
- •
likelihood vs. probability
- •
likelihood — a qualitative measurement (rare, possible, almost certain); probability — a quantitative, statistical measurement, often based on historical data; often used interchangeably in casual conversation
- •
- •
- •
risk register
- •
documents each identified risk, possible solutions, a risk owner responsible for managing it, and a risk threshold (where mitigation cost roughly equals the value gained by mitigating)
- •
- •
- •