Risk is the potential for adverse impact when a realistic threat exploits a vulnerability or hazardous condition. A useful assessment focuses on defined assets, scope, likelihood, and impact rather than sensational scenarios. section 6.3.1
A practical risk assessment follows a bounded sequence:
- Set the scope and define its assets, boundaries, systems, and data before analysis begins. section 6.3.1
- Identify realistic current and potential threats relevant to the organization, avoiding exaggerated scenarios. section 6.3.1
- Determine vulnerabilities using software analysis and known vulnerability sources such as the Common Vulnerabilities and Exposures database. section 6.3.1
- Interpret likelihood and impact together to support focused risk management and reporting. section 6.3.1
A scope boundary prevents analysis drift
An assessment may target a product, planned change, new implementation, critical asset, office location, data center, or the organization. Keeping that boundary explicit limits scope creep. A custom-built application may also require additional investigation because organization-specific software may have no CVE entry. section 6.3.1
Figure 6.3 Guide for conducting risk assessments
Use the guide to navigate the assessment sequence from preparation through risk reporting. section 6.3.1
