Riskanalysis

Risk analysis forms the foundation of every Information Security Management System (ISMS). It is the structured process for the systematic identification, assessment, and treatment of risks in the field of information security. Without a sound risk analysis, organizations cannot adequately protect their critical information assets.

Core Objectives of Risk Analysis

• Create transparency: Make potential threats to information assets visible
• Enable prioritization: Focus resources specifically on the greatest risks
• Ensure compliance: Meet regulatory requirements (ISO 27001, BSI IT-Grundschutz)
• Promote proactivity: Switch from reactive to preventive security strategy

Relevance in ISMS Context

According to ISO 27001:2022, risk analysis is not optional but a central component of the ISMS. It serves as the basis for:

• The selection of appropriate security measures (Controls from Annex A)
• The creation of the Statement of Applicability (SoA)
• The continuous improvement of information security

Practice Tip: A risk analysis is particularly necessary when assets have high or very high protection requirements regarding confidentiality, integrity, or availability.

Methodological Approaches: ISO 27001 vs. BSI IT-Grundschutz

ISO 27001 Approach

Characteristics:

• Flexible and individual: Organization defines its own methodology
• Risk-based: Continuous assessment and adaptation
• Internationally recognized: Global standard
• Demanding: Requires methodological maturity

Suitable for:

• Internationally operating companies
• Organizations with specific requirements
• Industries with high regulatory requirements (finance, healthcare)

BSI IT-Grundschutz Approach

Characteristics:

• Structured and comprehensive: Predefined modules and threat catalogs
• Layer model: Multiple security levels reduce dependence on precise assessment
• Practice-oriented: Based on proven standards
• Guided: Clear specifications and guidelines

Suitable for:

• German authorities and public administration
• Companies with complex IT landscapes
• Organizations with less experience in risk assessment

Best Practice: Many organizations combine both approaches - use the structure of IT-Grundschutz with the flexibility of ISO 27001.

The Risk Management Process in Detail

1. Asset Identification

Objective: Complete capture of all information assets worth protecting

Procedure:

• Inventory: Capture hardware, software, data, processes, and personnel
• Grouping: Combine similar assets into Target Object Groups (TOG)
• Classification: Define protection requirements (normal, high, very high)

Practice Example: Instead of evaluating 500 individual servers, they are grouped by operating system, function, or criticality (e.g., “All Oracle Linux Servers - Production”).

2. Risk Identification

Objective: Systematically capture threats and vulnerabilities

Components:

• Threats: What could go wrong?
• Vulnerabilities: Where are we vulnerable?
• Damage scenarios: What would be the consequences?

Catalogs and Sources:

• BSI IT-Grundschutz Compendium (Threat catalog)
• CVE databases for technical vulnerabilities
• Industry-specific threat intelligence

3. Risk Assessment

Central Concepts:

Inherent Risk

Definition: The risk without any protective measures - the “naked” threat situation.

Example: Unencrypted data transmission during server migration

• Probability of occurrence: High
• Damage potential: €175,000
• Inherent risk: High

Target Risk

Definition: The acceptable risk level after implementation of measures - in accordance with the organization’s risk appetite.

Determination based on:

• Regulatory requirements
• Business objectives
• Stakeholder expectations
• Cost-benefit analysis

4. Risk Treatment

Four Strategies:

A. Risk Reduction

• Most common strategy: Implement controls
• Example: Encryption, access controls, monitoring
• Implementation: Select controls from ISO 27001 Annex A

B. Risk Avoidance

• Stop activity: Eliminate risk source
• Example: Renounce cloud storage of critical data
• When sensible: Risk exceeds any possible benefit

C. Risk Transfer

• Shift responsibility: Insurance or outsourcing
• Example: Cyber insurance, managed security services
• Important: Risk remains, only responsibility is shared

D. Risk Acceptance

• Conscious decision: Tolerate risk
• Prerequisite: Within risk tolerance
• Documentation: Formal acceptance by management required

5. Residual Risk Management

Definition: The remaining risk after implementation of all measures.

Process:

1. Assess effectiveness of implemented controls
2. Recalculate residual risk
3. Compare with target risk
4. If necessary, take further measures or formally accept

Practice Tip: Residual risk is never zero - it’s about an acceptable level, not perfection.

The 5-Step Workflow

1. Risk Identification (Yellow)

   • Assign threats
   • Document vulnerabilities
   • Define damage scenarios

2. Risk Assessment (Yellow)

   • Determine inherent risk
   • Define target risk
   • Complete documentation

3. Risk Treatment (Yellow)

   • Choose strategy
   • Plan measures
   • Assign responsibilities

4. Risk Mitigation (Yellow)

   • Implement controls
   • Execute measures
   • Monitor status

5. Residual Risk (Green = Completed)

   • Assess residual risk
   • Obtain acceptance
   • Complete documentation

Color Coding:

• Green: Step completed
• Yellow: In progress
• Gray: Not yet started

Authorization Concept

Global Role: ISMS_RISKS_ANALYSIS_ACCESS

• Basic requirement for access to risk analysis

Granular Permissions:

• Risks - Read/Create/Edit/Delete
• Threats - Assign/Edit/Delete
• Measures - Create/Edit/Delete
• Controls - Assign/Edit/Delete
• Vulnerabilities - Create/Edit/Delete

Glossary

Asset: Any value to the organization (hardware, software, data, processes, personnel)

Control: Security measure for risk mitigation (technical, organizational, physical)

CVE: Common Vulnerabilities and Exposures - database of known vulnerabilities

GRC: Governance, Risk Management, and Compliance

Inherent Risk: Risk without consideration of controls

Residual Risk: Remaining risk after implementation of measures

SoA: Statement of Applicability - applicability statement for ISO 27001

TOG: Target Object Group - grouping of similar assets in the ISMS

Target Risk: Desired/acceptable risk level

Key Messages at a Glance

Risk analysis is mandatory: No ISO 27001 certification and no effective ISMS without systematic risk analysis.

Choose methodology: ISO 27001 for flexibility, BSI IT-Grundschutz for structure - or combine both.

5-phase process: Asset identification → Risk identification → Assessment → Treatment → Residual risk management.

Tool support essential: Manual risk analysis is no longer contemporary in complex environments.

Continuity instead of project: Risk analysis is an ongoing process, not a one-time activity.