/risk-assessment

name: risk-assessment
description: >-
  Run a structured security risk assessment and maintain a risk register —
  identify, analyze, evaluate, and treat risks (ISO 27005 / NIST SP 800-30) against
  the organization's risk criteria. Use for an enterprise/security risk assessment,
  risk register upkeep, or treatment decisions.

Goal

A defensible risk register: the organization's security risks identified, analyzed against consistent criteria, evaluated against risk appetite, and assigned explicit treatment decisions with owners.

Process (ISO 27005 / NIST 800-30)

1. **Establish context** — scope, assets in scope, the risk criteria (likelihood/ impact scales) and the org's risk appetite/acceptance thresholds. 2. **Identify risks** — asset × threat × vulnerability scenarios (and the consequence). Draw on `threat-modeling`, findings, incidents (`dfir`), and threat intel. 3. **Analyze** — assign likelihood and impact per the defined scales; derive a risk level. Note existing controls and their effect (inherent vs. residual risk). 4. **Evaluate** — compare residual risk to the criteria/appetite; decide which risks require treatment and their priority. 5. **Treat** — choose per risk: **mitigate** (control + cost), **transfer** (insurance/contract), **avoid** (stop the activity), or **accept** (with owner and documented sign-off). Define the treatment plan. 6. **Register & monitor** — record in the risk register (ID, description, owner, inherent/residual level, treatment, status, review date); review on a cadence and on change.

Output

A risk register + a risk heat map, with treatment plans and accountable owners. Use `security-reporting`; visualize the heat map with `security-diagramming:infographic`. Feeds `compliance-assessment` (risk-based controls) and the CISO view.

Notes

Use consistent, documented criteria so risks are comparable and the register is defensible. Distinguish **inherent vs. residual** risk (after controls). This is the operational, register-based view; for financial/board framing of top risks use `ciso-toolkit:cyber-risk-quantification`. Accepted risk must be explicitly owned and signed off — never defaulted.