Level 2: Risk Management Lifecycle and Control Types

Reminder: ISC2 and CC are registered marks of ISC2, Inc. This course is independent. It is not affiliated with, endorsed or approved by ISC2, and it is not official training. The exam outline belongs to ISC2 and is free on its website.

In Level 1 you learned what security protects: confidentiality, integrity and availability (the CIA triad). This level covers how an organization decides which problems to deal with first, and how to deal with them. That process is called risk management. The current CC outline, in effect since 1 September 2026, lists the risk management lifecycle under Security Principles, the largest domain at 24%.

Step 1: Learn the Core Vocabulary

Memorize these five terms. Exam questions depend on them.

• Asset: anything of value to the organization, such as data, laptops, servers, people or reputation.
• Threat: something that could cause harm, such as a ransomware gang, a flood or a careless employee.
• Vulnerability: a weakness a threat can exploit, such as an unpatched server, a weak password or an unlocked door.
• Likelihood: how probable it is that the threat exploits the vulnerability.
• Impact: how much damage it would do if it happened (money, downtime, legal trouble, harm to CIA).

A risk exists only where an asset, a threat and a vulnerability meet. If a server has no vulnerability, or nothing threatens it, the risk is low.

Do this: For any scenario, write down one asset, one threat and one vulnerability before going further.

Step 2: Walk the Lifecycle

Risk management is a cycle. It does not end:

1. Identify: list assets, the threats to them and their vulnerabilities.
2. Assess: rate the likelihood and impact of each risk. A simple scale is Low/Medium/High, or 1-5 multiplied together (likelihood x impact = risk score).
3. Treat: choose a response: avoid, mitigate, transfer or accept.
4. Monitor: watch whether controls work and whether new threats appear, then go back to step 1.

Worked scenario

A small accounting firm keeps client tax files on a file server.

1. Asset: the client tax files (confidentiality matters most).
2. Threat: ransomware arriving through phishing email.
3. Vulnerability: staff have never had phishing training, and backups are stored on the same network.
4. Likelihood: High, because phishing is common and staff are untrained.
5. Impact: High, because of lost files, regulatory exposure and lost clients.
6. Risk score: High x High = a priority risk.
7. Recommended treatment: mitigate with phishing training, email filtering and offline backups. Also transfer part of the financial loss with cyber insurance.

Step 3: Choose a Risk Treatment

Each risk gets one or more of these four treatments:

• Avoid: stop the activity that creates the risk. Example: the firm stops letting staff use personal USB drives at all.
• Mitigate (reduce): add controls that lower likelihood or impact. Example: deploy multi-factor authentication.
• Transfer (share): shift the financial consequence to someone else, usually through insurance or a contract. Example: buy cyber insurance. Note that accountability is not transferred. The firm still answers to its clients.
• Accept: knowingly take the risk with no further action, because it is small or because fixing it costs more than the loss. Example: accept the risk that the office coffee machine's Wi-Fi fails.

The risk left over after treatment is residual risk. You can rarely bring risk down to zero.

Ignoring a risk is not acceptance. Acceptance is a documented decision made by management.

Step 4: Apply Risk Appetite and Risk Tolerance

• Risk appetite: the overall amount and type of risk leadership is willing to take to pursue its goals. Example: a startup has a high appetite and a hospital has a low appetite.
• Risk tolerance: the specific acceptable variation around that appetite, often a threshold. Example: no more than 4 hours of downtime for the billing system.

Do this: Compare the residual risk with the tolerance.

1. If the risk is within tolerance, accepting it is reasonable.
2. If it is above tolerance, mitigate or transfer it.
3. If no control brings it within tolerance, avoid it.

Step 5: Sort Controls into Three Types

Controls are the tools you use to mitigate risk. The CC exam groups them into three types:

Quick sorting test:

1. Is it software or a device setting? Then it is technical.
2. Is it a rule, document, check or training for people? Then it is administrative.
3. Can you touch it, or does it guard a space? Then it is physical.

Watch out: a badge reader is physical because it controls entry to a room, even though it contains electronics.

Where AI fits

AI tools are now assets and threat sources. Here is a typical workplace risk: an employee pastes client data into a public generative AI chatbot (threat: data leakage; vulnerability: no rules on AI use). Treat it with all three control types. Use an AI acceptable use policy (administrative), data loss prevention that blocks uploads (technical) and, for any on-site AI servers, locked server rooms (physical).

What the Exam Asks About This

• Classifying controls: you get one example and choose technical, administrative or physical.
• Choosing a treatment: scenarios that mention insurance usually point to transfer. Stopping an activity is avoid. Adding controls is mitigate. A low risk within tolerance is accept.
• Best-answer questions: several options may sound right. Pick the one that matches the organization's stated risk appetite and tolerance.
• Vocabulary traps: telling a threat apart from a vulnerability, and remembering that transferring a risk does not transfer accountability.

Key Takeaways

• Risk = a threat exploiting a vulnerability in an asset, rated by likelihood and impact.
• Lifecycle: identify, assess, treat, monitor, and then repeat.
• The four treatments are avoid, mitigate, transfer and accept. Ignoring a risk is never a treatment.
• Risk appetite is the overall stance and risk tolerance is the specific threshold. Use both to choose the treatment.
• Controls are technical (software or devices), administrative (policies and people) or physical (spaces and barriers).
• Residual risk remains after treatment, and accountability always stays with the organization.