{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/risk-assessment","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/risk-assessment/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/risk-assessment/"},"term":{"en":"Risk assessment","da":"Risikovurdering"},"aka":{"en":["risk analysis"],"da":["risikoanalyse"]},"domain":["security"],"cluster":"risk-management","layer":"governance","status":"current","summary":{"en":"Working out what could go wrong, how likely it is and how much harm it would do, so the biggest risks get handled first.","da":"At finde ud af, hvad der kan gå galt, hvor sandsynligt det er, og hvor meget skade det vil gøre, så de største risici håndteres først."},"body":{"formal":{"en":"The step in risk management that finds each risk by pairing an asset with a threat and a vulnerability, then rates it by likelihood and impact. It can be done with numbers or with scales such as low, medium and high.","da":"Det trin i risikostyringen, hvor hver risiko findes ved at koble et aktiv med en trussel og en sårbarhed, hvorefter den vurderes ud fra sandsynlighed og konsekvens. Det kan gøres med tal eller med skalaer som lav, middel og høj."},"plain":{"en":"Before a picnic you ask what could spoil it, how likely that is and how bad it would be - then you bring an umbrella rather than worrying about bears.","da":"Før en skovtur spørger man, hvad der kan ødelægge den, hvor sandsynligt det er, og hvor slemt det vil være - og så tager man en paraply med i stedet for at bekymre sig om bjørne."},"inPractice":{"en":"The owner of a small Danish web shop lists its payment system, customer data and warehouse, scores each threat from 1 to 5 for likelihood and impact, and puts the results on a heat map for the board.","da":"Ejeren af en lille dansk webshop skriver betalingssystemet, kundedata og lageret op, giver hver trussel point fra 1 til 5 for sandsynlighed og konsekvens og samler resultatet i et heat-map til bestyrelsen."},"whyItMatters":{"en":"Without it, decisions rest on gut feeling and the latest headline; a written assessment also shows auditors and authorities that the choices were made on purpose.","da":"Uden den bygger beslutninger på mavefornemmelse og den seneste overskrift; en skriftlig vurdering viser også revisorer og myndigheder, at valgene er truffet bevidst."}},"deepDive":{"en":"In ISO terminology risk assessment is the umbrella for three sub-steps: risk identification, risk analysis and risk evaluation (ISO 31000:2018 clauses 6.4.2 to 6.4.4; ISO/IEC 27005:2022 clauses 7.2 to 7.4). Analysis determines likelihood and consequence and thereby the level of risk; evaluation compares that level with the risk criteria to decide which risks need treatment and in what order. Using \"risk analysis\" as a synonym for the whole activity, as is common in everyday usage, blurs the distinction, and in Danish practice risikovurdering and risikoanalyse are likewise used loosely.\n\nISO/IEC 27001:2022 separates defining the process from running it. Clause 6.1.2 requires a defined assessment process with established acceptance criteria and criteria for performing assessments, producing consistent, valid and comparable results, identifying risks to confidentiality, integrity and availability within scope, assigning risk owners, and analysing and evaluating those risks. Clause 8.2 then requires assessments to be performed at planned intervals or when significant changes are proposed or occur, with the results retained as documented information. ISO/IEC 27005:2022 describes two identification approaches: an event-based approach working from risk sources and strategic scenarios, and an asset-based approach enumerating assets, threats and vulnerabilities in detail. It also replaced the older term incident scenario with risk scenario.\n\nNIST SP 800-30 Rev. 1 structures assessment as prepare, conduct, communicate and maintain, and places it on the three tiers defined in SP 800-39: organisation, mission or business process, and information system. Its risk model links threat sources, threat events, vulnerabilities and predisposing conditions, likelihood and impact, with example scales in Appendices D to I. The method can be qualitative, semi-quantitative or quantitative; the choice affects precision and cost but not the underlying structure.\n\nNeighbouring activities differ in object and output. A vulnerability assessment lists concrete technical weaknesses but does not by itself rate business risk; threat modelling analyses a design for what could go wrong, typically at development time; a business impact analysis measures impact over time without considering likelihood; and a GDPR data protection impact assessment under Art. 35 rates risk to the rights and freedoms of data subjects rather than to the organisation. A risk assessment consumes all four as inputs. Typical failures are scoring without agreed criteria, registers describing systems instead of business consequences, and one-off assessments never repeated when the environment changes.","da":"I ISO-terminologien er risikovurdering (risk assessment) paraplybegrebet for tre deltrin: risikoidentifikation, risikoanalyse og risikoevaluering (ISO 31000:2018 punkt 6.4.2 til 6.4.4; ISO/IEC 27005:2022 punkt 7.2 til 7.4). Analysen fastlægger sandsynlighed og konsekvens og dermed risikoniveauet; evalueringen sammenholder niveauet med risikokriterierne for at afgøre, hvilke risici der skal håndteres, og i hvilken rækkefølge. I daglig tale bruges risikoanalyse og risikovurdering ofte i flæng om hele aktiviteten, ligesom \"risk analysis\" på engelsk, og det udvisker forskellen.\n\nISO/IEC 27001:2022 skelner mellem at fastlægge processen og at udføre den. Punkt 6.1.2 kræver en defineret vurderingsproces med kriterier for risikoaccept og for, hvornår der skal vurderes, som giver konsistente, gyldige og sammenlignelige resultater, identificerer risici for fortrolighed, integritet og tilgængelighed inden for omfanget, udpeger risikoejere og analyserer og evaluerer risiciene. Punkt 8.2 kræver derefter, at vurderingerne udføres med planlagte intervaller, eller når væsentlige ændringer foreslås eller sker, og at resultaterne opbevares som dokumenteret information. ISO/IEC 27005:2022 beskriver to tilgange til identifikation: en hændelsesbaseret, der tager udgangspunkt i risikokilder og strategiske scenarier, og en aktivbaseret, der gennemgår aktiver, trusler og sårbarheder i detaljer. Den erstattede også det ældre begreb hændelsesscenarie med risikoscenarie.\n\nNIST SP 800-30 Rev. 1 opdeler vurderingen i forberedelse, gennemførelse, kommunikation og vedligeholdelse og placerer den på de tre niveauer fra SP 800-39: organisation, forretningsproces og informationssystem. Risikomodellen forbinder trusselskilder, trusselshændelser, sårbarheder og disponerende forhold, sandsynlighed og konsekvens, med eksempler på skalaer i bilag D til I. Metoden kan være kvalitativ, semikvantitativ eller kvantitativ; valget påvirker præcision og omkostning, men ikke den grundlæggende struktur.\n\nNabodisciplinerne har et andet genstandsfelt og resultat. En sårbarhedsvurdering lister konkrete tekniske svagheder, men vurderer ikke i sig selv forretningsrisikoen; trusselsmodellering analyserer et design for, hvad der kan gå galt, typisk under udviklingen; en BIA måler konsekvens over tid uden at se på sandsynlighed; og en konsekvensanalyse vedrørende databeskyttelse efter databeskyttelsesforordningens art. 35 vurderer risikoen for de registreredes rettigheder og frihedsrettigheder frem for risikoen for organisationen. En risikovurdering bruger alle fire som input. Typiske fejl er scoring uden aftalte kriterier, registre, der beskriver systemer i stedet for forretningskonsekvenser, og engangsvurderinger, der aldrig gentages, når omgivelserne ændrer sig."},"edges":[{"type":"requires","to":"security/risk","confidence":"high","strength":"normal"},{"type":"requires","to":"security/likelihood","confidence":"high","strength":"normal"},{"type":"requires","to":"security/impact","confidence":"high","strength":"normal"},{"type":"requires","to":"security/asset","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/risk-management","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/vulnerability-assessment","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/threat-landscape","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/threat-modelling","why":{"en":"A threat model lists what could go wrong in a design; a risk assessment weighs how likely and how costly each of those things is.","da":"En trusselsmodel viser, hvad der kan gå galt i et design; en risikovurdering vejer, hvor sandsynligt og hvor dyrt hver af de ting er."},"confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-30 Rev. 1 - Guide for Conducting Risk Assessments","tier":"standard","publisher":"NIST"},{"title":"ISO/IEC 27005:2022 - Guidance on managing information security risks","tier":"standard","publisher":"ISO/IEC"}],"draft":true}