Risk Assessment
The structured process of identifying, analyzing, and evaluating risks to determine what treatment they need. Defined in ISO 27005 and central to every major compliance framework.
Why it matters
Without risk assessment, security decisions are guesswork. You cannot allocate resources, justify budgets, or satisfy auditors if you have not formally identified what threatens your organization and how likely those threats are to materialize. Risk assessment turns vague concerns into prioritized, actionable items with clear ownership.
In practice
A risk assessment typically follows a repeating cycle: identify assets and threats, estimate likelihood and impact, evaluate against your risk appetite, then decide on treatment (mitigate, accept, transfer, or avoid). In vucavoid, every risk carries a living assessment history, feeds your VUCA score, and links directly to the controls that treat it.