CISM Domain 2: Information Security Risk Management (20%)

Overview

Information Security Risk Management covers how the security manager identifies, analyzes and responds to information risk. Part A, Information Security Risk Assessment, spans the emerging risk and threat landscape, vulnerability and control deficiency analysis, and risk assessment and analysis. Part B, Information Security Risk Response, covers risk treatment options, risk and control ownership, and risk monitoring and reporting.

Candidates must link technical findings to business impact and likelihood, recognize when a control gap rather than a missing tool is the problem, and know that risk owners decide treatment within the appetite set under Domain 1. The domain feeds Domain 3, where chosen treatments become controls in the program, and Domain 4, where the business impact analysis and incident lessons update the risk picture.

How it's tested

Domain 2 items are scenario questions about sequence and ownership. A new threat, a failed control, an assessment result or a cost-benefit dilemma is described, and you choose the FIRST step, the BEST treatment or the MOST important reporting action. The answer usually reflects business impact, the risk owner's decision and the appetite.

Assess before you act

A new vulnerability or threat is reported. The correct answer evaluates likelihood and impact to the business before selecting or deploying a control.
Choose the treatment

A risk with known cost, impact and appetite is described. You pick mitigate, transfer, avoid or accept based on cost relative to benefit and the appetite.
Owner and reporting

Residual risk exceeds appetite, or a control owner has not acted. The answer routes the issue to the accountable risk owner or escalates it through reporting.

Reasoning it through

A penetration test finds that a customer portal accepts weak passwords. Options are to enforce a stronger standard immediately, buy multifactor authentication, report to the board or determine the business impact and likelihood. A vulnerability is not yet a risk until it is assessed against the asset's value and threat exposure, so analysis comes first; it tells the owner whether treatment is needed and which option is proportionate.

Sub-topics 6

Official sub-topics from the ISACA outline, in outline order.

2.1 Emerging Risk and Threat LandscapeTracking new threats, technologies and business changes that create new risk.

What it means: The threat landscape covers who might cause harm and how, including criminal groups, insiders, nation-state actors and supply chain attacks, while emerging risk arises from new technologies such as cloud services, AI tools and IoT, and from business changes such as mergers or new markets.
What to understand: Threat intelligence is useful only when it is related to the organization's own assets and objectives. The manager builds a process to scan for change and trigger reassessment, rather than reacting to every headline.
How it shows up: A widely reported new attack technique appears in the news, and the question asks what the security manager should do FIRST: determine whether and how it affects the organization's assets.
Common confusion: Treating a threat report as proof of risk; a threat matters only where it meets a vulnerability in an asset the business values.

2.2 Vulnerability and Control Deficiency AnalysisFinding weaknesses in systems and gaps in the controls meant to protect them.

What it means: Vulnerability analysis finds weaknesses in technology, processes or people, while control deficiency analysis checks whether existing controls are designed correctly and operating effectively.
What to understand: A control can exist on paper and still fail through poor design or poor operation, and the gap between the control objective and actual performance is a risk input. Root-cause analysis of the deficiency, such as missing ownership or an unclear procedure, prevents the same gap from recurring.
How it shows up: An assessment shows a required control is documented but not performed, and the question asks the BEST response: identify why it is not operating and who owns it, not add a second control.
Common confusion: Equating a vulnerability scan with a risk assessment; scans find technical weaknesses but say nothing about business impact or control effectiveness.

2.3 Risk Assessment and AnalysisEstimating likelihood and impact to rank risk against the appetite.

What it means: Risk assessment identifies assets, threats, vulnerabilities and existing controls, then analysis estimates likelihood and impact using qualitative scales, quantitative values or a mix of both.
What to understand: Quantitative analysis uses single loss expectancy (SLE = asset value x exposure factor) and annualized loss expectancy (ALE = SLE x annualized rate of occurrence), which supports cost-benefit decisions; qualitative analysis ranks risk faster when data is scarce. Inherent risk is the level before controls, and residual risk is what remains after them.
How it shows up: A scenario gives an asset value, exposure factor and frequency and asks whether a control costing a stated annual amount is justified, or asks the PRIMARY purpose of the assessment: to prioritize treatment by business impact.
Common confusion: Assuming quantitative results are always more accurate; they are only as reliable as the input estimates.

2.4 Risk Treatment / Risk Response OptionsChoosing to mitigate, transfer, avoid or accept each risk.

What it means: The four response options are mitigate (reduce likelihood or impact with controls), transfer or share (such as insurance or contractual terms), avoid (stop the activity) and accept (knowingly retain the risk).
What to understand: The choice depends on appetite and on whether the cost of treatment is proportional to the reduction it buys. Transfer moves financial impact, not accountability or reputational harm, and acceptance must be a documented decision by the risk owner, not neglect.
How it shows up: A control would cost more than the expected annual loss it prevents, and the question asks the BEST response: accept or transfer, with the owner's documented decision.
Common confusion: Believing insurance removes the risk; it compensates financially while the organization still suffers the incident and owns the outcome.

2.5 Risk and Control OwnershipAssigning who is accountable for each risk and each control.

What it means: A risk owner is the person with authority and accountability to decide how a risk is treated, usually a business leader; a control owner is accountable for ensuring a specific control is designed and operating as intended.
What to understand: Every risk in the register needs a named owner with enough authority to fund or accept the response. The security manager facilitates, advises and monitors, but does not own business risk.
How it shows up: A risk register shows many risks without clear owners, or a control is failing and nobody acts, and the question asks what to do FIRST: assign ownership.
Common confusion: Making the security manager or IT the default owner of every information risk.

2.6 Risk Monitoring and ReportingKeeping risk visible with indicators, registers and reports to decision makers.

What it means: Monitoring tracks whether risk levels, threats and control performance change, using key risk indicators (KRIs) and the risk register; reporting communicates the current risk profile to owners, senior management and the board.
What to understand: KRIs are forward-looking signals that a risk is approaching a threshold, and they should trigger escalation when tolerance is breached. Reports must be tailored to the audience: executives need trends, exposure against appetite and decisions required, not raw technical data.
How it shows up: Residual risk has risen above appetite after a business change, and the question asks the BEST action: report it to the risk owner and senior management for a treatment decision.
Common confusion: Treating a key performance indicator as a key risk indicator; KPIs show how well a process performs, while KRIs warn of rising exposure.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

Risk

The combination of the likelihood that a threat exploits a vulnerability and the impact on an asset the business values.

Remember
No asset value or impact means no meaningful risk statement.

Tested as
Many stems test whether you can tell a threat or vulnerability from an assessed risk.

Trap
Calling an unpatched server a risk before any likelihood or impact analysis.
Inherent vs. residual risk

Inherent risk is the exposure before controls are applied; residual risk is what remains after current controls operate.

Remember
Residual risk, not inherent risk, is compared with the appetite to decide further action.

Tested as
Questions ask which level management should accept or which level triggers treatment.

Trap
Comparing inherent risk to appetite and recommending controls that already exist.
Single loss expectancy (SLE)

Expected loss from one occurrence, calculated as asset value multiplied by exposure factor (the fraction of value lost).

Remember
SLE = AV x EF; an asset worth 400,000 with a 25% exposure factor has an SLE of 100,000.

Tested as
Appears in cost-benefit scenarios as an input to ALE.

Trap
Using the full asset value as SLE when only part of it would be lost.
Annualized loss expectancy (ALE)

Expected loss per year, calculated as SLE multiplied by the annualized rate of occurrence (ARO).

Remember
ALE = SLE x ARO; an SLE of 100,000 occurring once every four years (ARO 0.25) gives an ALE of 25,000.

Tested as
A control is cost-justified when the ALE reduction it delivers exceeds its annual cost.

Trap
Comparing a control's total multi-year cost to a single year of ALE.
Risk appetite in treatment decisions

Treatment aims to bring residual risk within the appetite set by senior management, not to eliminate all risk.

Remember
Risk at or below appetite can be accepted; above it needs further treatment or an explicit owner decision.

Tested as
Treatment questions often give a residual figure and an appetite threshold.

Trap
Recommending more controls for a risk already within appetite.
Risk treatment options

Mitigate, transfer or share, avoid and accept are the four responses to a risk.

Remember
Avoidance means stopping the activity; acceptance must be documented by the owner.

Tested as
BEST-response questions hinge on cost, appetite and feasibility.

Trap
Defaulting to mitigation when cost exceeds benefit.
Risk owner

The person accountable for a risk who has authority to decide and fund its treatment, typically a business manager.

Remember
The owner decides; the security manager advises and reports.

Tested as
Who-decides questions in this domain usually resolve to the risk owner.

Trap
Choosing the CISO or the system administrator as owner.
Control owner

The person accountable for a control's design and effective operation, who may differ from the risk owner.

Remember
A failing control is first raised with its owner.

Tested as
Appears when a control is documented but not performed.

Trap
Confusing the control owner with the person who performs the control daily.
Key risk indicator (KRI)

A metric that signals a change in exposure early enough to act, such as the number of critical systems past patch deadlines.

Remember
Good KRIs are predictive, measurable and tied to a threshold that triggers escalation.

Tested as
Asked as the BEST way to monitor a specific risk over time.

Trap
Choosing a lagging count of past incidents as the early warning.
Risk register

The central record of identified risks with their owners, ratings, treatments and status.

Remember
A register without owners and review dates is a list, not a management tool.

Tested as
Used in scenarios about tracking and reporting risk consistently.

Trap
Treating creation of the register as the end of risk management.
Control deficiency

A control that is missing, poorly designed or not operating as intended, leaving a gap between the control objective and actual protection.

Remember
Fix design or operation at the root cause before layering new controls.

Tested as
Appears when audits or tests show controls exist only on paper.

Trap
Buying a new tool to compensate for a process nobody follows.
Risk aggregation

Combining several individually acceptable risks that share a cause or asset, which together may exceed appetite.

Remember
Report the combined exposure, not just each line item.

Tested as
Reporting scenarios with many small, related risks.

Trap
Accepting each risk separately without seeing the total.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Mitigate vs. transfer vs. avoid vs. accept

Concept	Meaning	Key difference	Common trap
Mitigate	Apply controls that reduce likelihood or impact.	Changes the risk level itself.	Choosing it when the control costs more than the loss it prevents.
Transfer or share	Shift financial impact to a third party through insurance or contract terms.	Moves cost, not accountability or reputational harm.	Believing the organization no longer owns the risk.
Avoid	Stop or decline the activity that creates the risk.	Removes the risk along with the business benefit.	Recommending avoidance for an activity central to business objectives.
Accept	Knowingly retain the risk, documented and approved by the risk owner.	No new control; requires monitoring and periodic review.	Treating doing nothing without a documented decision as acceptance.

Threat vs. vulnerability vs. risk

Concept	Meaning	Key difference	Common trap
Threat	A potential cause of harm, such as a ransomware group or a careless insider.	Exists outside the asset; usually cannot be controlled directly.	Trying to eliminate the threat instead of reducing exposure.
Vulnerability	A weakness that a threat could exploit, such as missing patches or weak procedures.	Within the organization's control to reduce.	Labeling every vulnerability as a high risk before analysis.
Risk	Likelihood of a threat exploiting a vulnerability combined with the business impact.	Requires asset value and impact, so it is a business measure.	Reporting vulnerability counts to executives as if they were risk.

Qualitative vs. quantitative risk analysis

Concept	Meaning	Key difference	Common trap
Qualitative	Ranks likelihood and impact on scales such as high, medium and low.	Fast and inclusive when data is scarce, but subjective.	Using it to justify a precise investment amount.
Quantitative	Assigns monetary values through SLE, ARO and ALE.	Supports cost-benefit decisions, but depends on reliable estimates.	Trusting precise figures built on guessed inputs.

KRI vs. KPI vs. KGI

Concept	Meaning	Key difference	Common trap
Key risk indicator (KRI)	Signals rising exposure to a specific risk.	Forward-looking warning tied to a threshold.	Using an incident count after the fact as a KRI.
Key performance indicator (KPI)	Measures how well a process or control performs.	Shows efficiency or effectiveness of activity.	Reporting KPI improvement as proof risk has fallen.
Key goal indicator (KGI)	Shows whether a business or program goal was achieved.	Outcome measure, typically lagging.	Expecting it to give early warning.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

Patch first, assess later

What candidates pick
Deploying a fix or control as soon as a vulnerability is reported.

Why it looks right
Fast remediation looks responsible and removes the weakness.

Why it's wrong
Without likelihood and impact analysis, the manager cannot tell whether the response is proportionate or how it ranks against other risks.

Clue to watch for A newly reported vulnerability with no stated impact, and a FIRST stem.
Insurance makes it someone else's problem

What candidates pick
Considering a risk closed once cyber insurance is bought.

Why it looks right
Insurance is a recognized treatment and caps the financial loss.

Why it's wrong
Transfer covers part of the financial impact; the organization keeps accountability, operational disruption and reputational damage.

Clue to watch for A question about who remains accountable or what risk remains after transfer.
More controls are always better

What candidates pick
Adding a control for a risk whose residual level is already within appetite.

Why it looks right
Extra protection seems harmless and security-minded.

Why it's wrong
Spending beyond appetite wastes resources that should go to risks above it, and CISM rewards proportional treatment.

Clue to watch for A residual risk figure stated as below or within appetite or tolerance.
Security owns the risk

What candidates pick
Assigning ownership of an information risk to the CISO or IT.

Why it looks right
They understand the technology and the threat best.

Why it's wrong
Owners must have authority over the business process and budget; security facilitates and monitors.

Clue to watch for A stem asking who should decide treatment or accept the residual risk.
Cost compared on the wrong basis

What candidates pick
Rejecting a control because its multi-year total exceeds one year's ALE.

Why it looks right
The large total looks bigger than the expected loss.

Why it's wrong
Cost-benefit compares annual control cost with annual reduction in ALE, so both sides must use the same period.

Clue to watch for A quantitative stem giving ALE per year and a control cost over several years.
Add a new control for a failing one

What candidates pick
Introducing a compensating tool when an existing control is not performed.

Why it looks right
It closes the gap quickly without confronting the owner.

Why it's wrong
The deficiency's cause, such as no owner or an unclear procedure, remains and will undermine the new control too.

Clue to watch for A documented control found not operating during testing or audit.

Answer framework

Apply this sequence whenever a Domain 2 scenario presents a new finding or a treatment choice.

Identify the asset, its business value and the objective that would suffer if it were compromised, and separate the threat from the vulnerability the scenario describes.
Analyze likelihood and impact, including existing controls, to determine residual risk before choosing any response.
Compare residual risk with the stated appetite or tolerance and decide whether further treatment is needed at all.
Select mitigate, transfer, avoid or accept on cost relative to benefit, and route the decision to the named risk owner.
Record the decision in the risk register, set KRIs and thresholds, and report changes to owners and senior management on a defined cycle.

Practice question

A risk assessment shows that an online ordering system has an ALE of 60,000 from fraud. A fraud-detection service would cut the ALE to 20,000 and costs 55,000 per year. Residual risk without it is above appetite. What should the security manager recommend?

Implement the fraud-detection service because residual risk exceeds appetite Accept the risk because it is above appetite only marginally Present alternative treatments, such as transfer or cheaper controls, to the risk owner Shut down the online ordering system to avoid the risk

Show the answer

Answer C. The service reduces ALE by 40,000 but costs 55,000 a year, so it is not cost-justified, yet the risk exceeds appetite and cannot simply be accepted. The manager should take alternatives such as insurance or cheaper controls to the risk owner. Implementing the service is the strongest distractor, but it spends more than it saves. Avoidance discards a core business activity.

Want more like this? The CISM practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Begin with Part A vocabulary: threat, vulnerability, risk, inherent and residual risk. Then work the quantitative formulas until SLE and ALE calculations and cost-benefit comparisons are automatic, because they show up as quick wins in scenarios and help you reason about proportionate treatment even in qualitative questions.

Move to Part B and study the four treatment options as decisions with consequences: what each changes, what it leaves behind and who must approve it. Pair this with ownership. Many Domain 2 errors come from assigning risk to security instead of the business, so practice naming the owner for every scenario you read.

The most underestimated topics are control deficiency analysis and monitoring. Candidates assume controls work once documented, and they confuse KRIs with KPIs. Write two or three KRIs for common risks such as phishing or unpatched systems, each with a threshold and an escalation path, to make the distinction concrete.

Afterwards, practice timed sets of FIRST and BEST questions and check each miss against the sequence of assess, compare with appetite, choose treatment, assign owner and report. Then read Domain 3 to see how chosen treatments become controls and metrics in the program.

FAQ

How much math is in Domain 2?

Expect basic quantitative reasoning such as SLE, ARO and ALE and cost-benefit comparisons. Most items are qualitative scenarios about sequence, ownership and treatment choice.

What is the difference between risk appetite and residual risk?

Appetite is the level of risk senior management is willing to accept. Residual risk is the exposure left after controls, and it is compared with appetite to decide whether more treatment is needed.

Who accepts risk in a CISM scenario?

The risk owner, usually the business manager accountable for the affected process, within the appetite set by senior management. The security manager documents and reports the decision.

Is a vulnerability scan a risk assessment?

No. A scan identifies technical weaknesses, while a risk assessment also considers threats, existing controls, likelihood and business impact.

When is risk acceptance the right answer?

When residual risk is within appetite, or when treatment costs more than the benefit and the owner makes a documented, informed decision to retain it.

How long should I study this domain?

Our planning estimate is about 35–45 hours within a 200-hour plan, with extra practice on cost-benefit and treatment questions if they are new to you.

How does Domain 2 relate to Domain 4?

The business impact analysis and incident lessons in Domain 4 update risk ratings, and incident priorities follow the impact analysis done here.

Related domains

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

CISM Domain 2: Information Security Risk Management

Overview

How it's tested

Assess before you act

Choose the treatment

Owner and reporting

Sub-topics 6

High-yield concepts

Risk

Inherent vs. residual risk

Single loss expectancy (SLE)

Annualized loss expectancy (ALE)

Risk appetite in treatment decisions

Risk treatment options

Risk owner

Control owner

Key risk indicator (KRI)

Risk register

Control deficiency

Risk aggregation

Side by side

Mitigate vs. transfer vs. avoid vs. accept

Threat vs. vulnerability vs. risk

Qualitative vs. quantitative risk analysis

KRI vs. KPI vs. KGI

Exam traps

Patch first, assess later

Insurance makes it someone else's problem

More controls are always better

Security owns the risk

Cost compared on the wrong basis

Add a new control for a failing one

Answer framework

Practice question

Checklist

Study strategy

FAQ

Other Cybersecurity certifications

Test your Domain 2 knowledge

Keep going