Risk identification

ISO 31000:2018 clause 6.4.2 describes risk identification as finding, recognising and describing risks, and asks the organisation to consider, among other things, tangible and intangible risk sources, causes and events, threats and opportunities, vulnerabilities and capabilities, changes in context, emerging risks and the limits of its own knowledge. ISO/IEC 27005:2022 clause 7.2 narrows this to information security: risks associated with loss of confidentiality, integrity and availability are identified either through an event-based approach, starting from risk sources and high-level scenarios, or through an asset-based approach enumerating assets, threats and vulnerabilities in detail. The 2022 edition also introduced the term risk scenario, a sequence or combination of events leading from the initial cause to the unwanted consequence, in place of the older incident scenario.

The unit of output is a risk statement precise enough to be analysed. A usable pattern names the risk source or threat, the vulnerability or condition exploited, the affected asset and the business consequence, for example: a ransomware group exploits an unpatched VPN appliance, encrypts the ERP system and halts order handling. Statements such as "cyber attack" or "GDPR" are categories, not risks; they cannot be scored because they have no defined mechanism or consequence. Each identified risk is recorded in the risk register with an owner, even before analysis.

Coverage depends on sources and technique. Inputs typically include national threat assessments, sector warnings, frameworks such as MITRE ATT&CK, internal incident and near-miss history, audit and penetration-test findings, vulnerability scan results, supplier dependencies and interviews with process owners. ISO/IEC 31010:2019 catalogues techniques from brainstorming and structured interviews to the Delphi method, checklists, SWIFT (structured what-if) and bow-tie analysis. NIST SP 800-30 Rev. 1 Appendix D distinguishes adversarial, accidental, structural and environmental threat sources, a useful check that identification does not stop at attackers; NIS2 Art. 21(2) similarly requires measures based on an all-hazards approach, covering failures, errors and physical events as well as attacks.

The main failure modes are narrow participation, where an IT-only workshop misses process, supplier and people risks; availability bias, where last month's headline dominates; confusing controls that are missing with risks ("no SIEM" is a finding, not a risk); and treating identification as a one-time event instead of repeating it when systems, suppliers or the threat landscape change. Identification deliberately stops before rating, since scoring during brainstorming tends to shut down discussion of unlikely but severe scenarios.