Review questions — Cybersecurity as Business Risk and Governance

Integrated Summary: Business Risk, Governance, and Priorities

This subject starts with business impact. An asset is something valuable or necessary for work to continue; a threat can cause harm; a weakness is a condition that may enable the threat or increase its impact; risk is the scenario connecting those elements to potential business harm; and a control is intended to change likelihood, impact, detection speed, or recovery capability. We used confidentiality, integrity, and availability to describe what may be harmed, then turned vague statements such as “phishing is a risk” into risk statements that identify the asset, event, weakness, and impact without false precision.

We then connected risk to governance. Governance clarifies who decides, who operates, who oversees, and when a decision must be escalated. We introduced the six NIST CSF 2.0 Functions: Govern, Identify, Protect, Detect, Respond, and Recover. The goal is not memorization but understanding that cybersecurity management includes direction, risk understanding, protection, detection, response, and recovery as connected activities. We also distinguished the risk owner, control owner, security team, and governing body, separated policy from procedure, and used risk tolerance as a practical delegation and escalation boundary rather than a magic number.

The third lesson converted these ideas into a simple risk register. A qualitative 1–5 likelihood and impact scale can be multiplied to create a prioritization indicator, but the result is not a scientific probability, an expected monetary value, or proof that a score of 20 is exactly twice the risk of a score of 10. Context still matters. We distinguished inherent from residual risk and considered treatments such as reducing, avoiding, sharing or transferring, and authorized acceptance. A useful treatment has an owner, date, evidence, and follow-up.

Finally, we moved from “What is the risk?” to “How do we know we are improving?” We used a baseline, a Current state, and a Target state to identify gaps and convert them into action. A good metric serves a specific decision: account coverage, restore-test success, the age of exceptions, or another measure appropriate to the outcome. We do not confuse the existence of a document or tool with achievement of the result. Continuous improvement is a loop: define the outcome and scope, gather evidence, interpret the gap, assign an action with an owner and date, then measure again. If the overall number improves while a sensitive exception remains, we acknowledge progress and continue addressing the residual risk. This is how cybersecurity becomes part of business risk management rather than a separate list of tools.