Risk Assessment Evaluation and Analysis is the structured, repeatable process of identifying information assets and their business value, cataloging threats and vulnerabilities, estimating the likelihood and impact of adverse events, scoring the resulting risks, and comparing those scores against organizational acceptance criteria — producing a prioritized, defensible picture of the organization's information security risk posture. It is the analytical engine that converts raw security data (vulnerability scans, threat intelligence, asset inventories, control audits) into risk ratings that drive investment, remediation, and reporting decisions. The process comprises three sequential activities: (1) Risk Assessment — identifying and analyzing risks; (2) Risk Evaluation — comparing analyzed risks against risk appetite and acceptance thresholds; (3) Documentation and Communication — producing artifacts (risk registers, executive summaries, board reports) calibrated to each audience.
Where it stops · what it isn't
- —IS: Systematic identification of assets, threats, vulnerabilities, and likelihood/impact estimation using a defined methodology (qualitative, quantitative, or hybrid).
- —IS: Evaluation of assessed risk ratings against organizational risk appetite, tolerance thresholds, and regulatory criteria.
- —IS: Production of risk assessment artifacts including risk registers, findings reports, and executive summaries.
- —IS: Selection and justification of assessment methodology (e.g., FAIR, NIST SP 800-30, ISO/IEC 27005, qualitative risk matrix).
- —IS NOT: Risk response planning or treatment selection — covered by the downstream competency 'Information Risk Response.'
- —IS NOT: Threat landscape analysis — understanding external threats as an intelligence discipline is a sibling competency ('Risk and Threat Landscape').
- —IS NOT: Vulnerability scanning or penetration testing execution — those are technical inputs to the assessment, not the assessment itself.
- —IS NOT: Compliance auditing — regulatory gap analysis may inform a risk assessment but is not equivalent to one.
- —IS NOT: Continuous monitoring operations — operational monitoring feeds data into assessments but is a distinct function.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
FEEDS INTOInformation Risk Response
ENABLESVulnerability and Control Deficiency AnalysisRisk Monitoring Reporting and CommunicationSecurity Investment Prioritization
RELATED TORisk and Threat Landscape
PART OFInformation Security Risk Management (CISM Domain 2)
REQUIRESAsset Inventory and Classification
CONSTRAINSRisk Acceptance Decisions