GRC · 5 min
Understanding Cyber Risk
Likelihood, impact, and the difference between severe and important
This lesson explains the concept, then checks your understanding in a short interactive exercise.
The moving parts
Cyber risk describes the possibility of harm to something the organization cares about.
- Asset or objective — what has value, and what the business is trying to do
- Threat — who or what could cause harm
- Vulnerability or exposure — the weakness that makes it possible
- Likelihood — how plausible it is in practice
- Impact — what it would actually cost if it happened
Inherent vs residual risk
Inherent risk is the exposure before your controls are considered. Residual risk is what remains after controls and other treatment operate as designed. The risk owner or leadership then decides whether to accept that remaining risk, reduce it further, transfer or share it, or avoid the activity.
- Controls reduce risk; they rarely remove it
- A control that isn't operating doesn't reduce anything
- Accepting residual risk is a legitimate, documented decision
Loading the interactive lesson…