Lesson 10 of 16 · Level 3: Advanced
Risk Management and the NIST Cybersecurity Framework
- ⏱ 13 min read
- ❓ 4 review questions
- ✍️ Exercise with solution
- 📥 Downloadable template
In this lesson
- The vocabulary of risk management: assets, threats, likelihood, impact, inherent and residual risk.
- How to score risks on a 5×5 matrix and read a heat map.
- How to estimate expected yearly losses (SLE, ARO, ALE) and decide whether a control pays for itself.
- The four ways to treat a risk: mitigate, transfer, avoid or accept.
- How NIST CSF 2.0 organizes a security program into six functions, with profiles and tiers.
Every control in the small-business checklist is tagged with its NIST CSF 2.0 function, and the summary shows % compliance per function: your first "current profile."
- cybersecurity-checklist.xlsx · Small Business Checklist sheet
No organization can fix everything at once, so security is really a series of decisions about what to fix first. Risk management is the discipline of making those decisions on purpose: identify what could go wrong, estimate how likely and how harmful it would be, and choose a response. The NIST Cybersecurity Framework (CSF) 2.0 then gives you a common structure to organize the whole program. In this lesson you'll do both with a Portland online store, from a simple heat map to a dollar-based cost-benefit decision.
- List assets and risks
- Score likelihood and impact
- Put a dollar figure on it
- Choose a treatment
- Organize with NIST CSF
The vocabulary of risk
You met threats, vulnerabilities and risk in lesson 1. Risk management adds a few more terms you'll see in frameworks, audits and exams:
| Term | Meaning | Example for an online store |
|---|---|---|
| Asset | Something of value | The store's admin account, customer list, revenue during the holiday sale |
| Likelihood | How probable the event is in a given period | "Likely" if staff reuse passwords and there's no MFA |
| Impact | How much harm it would cause | Lost sales, refunds, breach notices, reputation |
| Inherent risk | Risk before any controls | Admin account protected only by a password |
| Residual risk | Risk left after controls | Same account with passkeys and alerts on new logins |
| Risk appetite | How much risk leadership is willing to accept to pursue its goals | "We accept short outages but never exposure of customer payment data" |
Qualitative scoring: the 5×5 matrix
The fastest method rates likelihood and impact from 1 (very low) to 5 (very high) and multiplies them:
Risk score = Likelihood (1–5) × Impact (1–5)
1–4 Low · 5–9 Medium · 10–14 High · 15–25 CriticalRose City Ceramics, a fictional online store in Portland, Oregon, with five employees, listed six risks:
| ID | Risk | Likelihood | Impact | Score | Level |
|---|---|---|---|---|---|
| R1 | Takeover of the store's admin account (password reuse, no MFA) | 4 | 5 | 20 | Critical |
| R2 | Ransomware on the office PC that holds order exports | 3 | 4 | 12 | High |
| R3 | A compromised third-party plugin alters the checkout page | 2 | 5 | 10 | High |
| R6 | Fake supplier invoice (business email compromise) | 3 | 3 | 9 | Medium |
| R4 | Traffic flood (DDoS) during the holiday sale | 2 | 3 | 6 | Medium |
| R5 | Loss of an encrypted laptop | 3 | 1 | 3 | Low |
- Low (1–4) R5Accept and monitor.
- Medium (5–9) R4, R6Treat within the next quarter.
- High and critical (10–25) R1, R2, R3Treat now; R1 first.
Notice R5: a lost laptop is fairly likely, but because it's encrypted, the impact is minimal. That's a control (encryption) visibly pushing a risk into the green.
1. A risk is rated likelihood 4 and impact 3 on a 5×5 matrix. Using this lesson's bands, what is its score and level?
4 × 3 = 12, which falls in the 10–14 band: High. Adding the two numbers instead of multiplying is a common mistake.
Quantitative risk: putting dollars on it
When you need to justify spending, translate risk into expected yearly losses:
SLE (single loss expectancy) = Asset value (AV) × Exposure factor (EF)
ALE (annualized loss expectancy) = SLE × ARO (annual rate of occurrence)
Control value per year = ALE before − ALE after − annual cost of the controlRose City Ceramics estimated two of its risks this way:
| Risk | Before the control | Control and yearly cost | After the control | Net value per year |
|---|---|---|---|---|
| R6: fake supplier invoice | SLE $18,000 × ARO 0.3 = ALE $5,400 | Call-back rule plus MFA on email: $600 | ARO falls to 0.03: ALE $540 | $5,400 − $540 − $600 = $4,260 |
| R2: ransomware on order system | AV $80,000 × EF 0.5 = SLE $40,000; × ARO 0.2 = ALE $8,000 | Immutable backups plus endpoint detection: $3,000 | EF falls to 0.1: SLE $8,000 × 0.2 = ALE $1,600 | $8,000 − $1,600 − $3,000 = $3,400 |
Both controls pay for themselves. Keep in mind that these inputs are estimates; the value of the exercise is forcing clear assumptions that others can question. An ARO of 0.3 means "about once every three or four years," and that guess should come from incident history, industry reports and honest judgment.
2. A data breach would cost a clinic $25,000 each time (SLE), and it expects one every two and a half years (ARO 0.4). What is the ALE?
ALE = SLE × ARO = $25,000 × 0.4 = $10,000 per year. A control that costs less than the reduction it achieves in that number is worth considering.
Four ways to treat a risk
Mitigate
Add controls that lower likelihood or impact: MFA, backups, training.
Rose City: passkeys on the store admin account (R1).Transfer
Shift the financial impact to someone else: cyber insurance, or contracts with providers.
Note: you transfer the cost, not the responsibility. Customers still blame you.Avoid
Stop the risky activity altogether.
Rose City: stop storing exported order files on the office PC (part of R2).Accept
Consciously live with a risk that's within your appetite, and write the decision down.
Rose City: the encrypted laptop risk (R5).All of this goes in a risk register: a simple table with the risk, owner, score, treatment, due date and residual score, reviewed every quarter.
3. A company buys a cyber insurance policy to cover ransomware recovery costs. Which risk treatment is this?
Insurance transfers part of the financial impact. It doesn't reduce the chance of an attack, which is why insurers usually require controls (mitigation) too.
NIST Cybersecurity Framework 2.0
The NIST CSF is a voluntary framework used by organizations of every size to describe and improve their security. Version 2.0, released on February 26, 2024, broadened its audience beyond critical infrastructure to all organizations and added a sixth function, Govern, at the center of the other five.
| Function | The question it answers | Small-business examples |
|---|---|---|
| Govern (GV) | Who's responsible, and what's our strategy, policy and risk appetite? | Name a security owner, write the WISP, manage supplier risk |
| Identify (ID) | What do we have, and what are our risks? | Asset inventory, risk register, lessons from incidents |
| Protect (PR) | How do we prevent or limit harm? | MFA, training, encryption, updates, backups |
| Detect (DE) | How do we notice something is wrong? | Login alerts, endpoint detection, log review |
| Respond (RS) | What do we do during an incident? | Incident plan, contacts, reporting, containment |
| Recover (RC) | How do we get back to normal? | Restore from backups, communicate with customers |
The functions break down into 22 categories. Govern has the most, reflecting the new emphasis on leadership and strategy:
Profiles and tiers
Two tools make the CSF practical. A Current Profile describes which outcomes you achieve today; a Target Profile describes where you want to be, based on your risks and obligations. The gap between them becomes your action plan. The checklist template does a simple version of this: % compliance per function is your current profile, and the controls marked "No" or "Partial" are the gap.
Tiers describe how mature your risk management practices are: Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable and Tier 4 Adaptive. A small business moving from "we react when something breaks" (Partial) to "we have approved policies and review them regularly" (Repeatable) is real progress; not every organization needs Tier 4.
4. Which function was added to the NIST Cybersecurity Framework in version 2.0?
CSF 2.0 added Govern, covering strategy, roles, policy, oversight and supply chain risk management. The original five functions remain: Identify, Protect, Detect, Respond and Recover.
Common mistakes
Rating every risk "high" to get budget.
Use defined scales so scores are comparable and credible.
Treating the risk register as a one-time document.
Review it every quarter and after every incident or major change.
Buying insurance instead of controls.
Combine them: controls lower risk, insurance covers part of what's left.
Trying to implement all 106 CSF subcategories at once.
Build a target profile for your size and risks, then close the biggest gaps first.
Practice exercise
A veterinary clinic in Albuquerque lists four risks: (a) phishing leads to email account takeover, likelihood 4, impact 4; (b) ransomware on the server, likelihood 3, impact 5; (c) theft of an encrypted laptop, likelihood 2, impact 2; (d) website defacement, likelihood 3, impact 2. Score and rank them, then answer: for (b), the clinic's operations are valued at $150,000, an attack would affect 40% of that value, and it expects one every 10 years (ARO 0.1). An immutable cloud backup plus endpoint detection costs $2,400 a year and would cut the exposure factor to 5%. Is the control worth it?
See solution
Scores: (a) 4 × 4 = 16, Critical; (b) 3 × 5 = 15, Critical; (c) 2 × 2 = 4, Low; (d) 3 × 2 = 6, Medium. Ranking: a, b, d, c.
Before: SLE = $150,000 × 0.40 = $60,000; ALE = $60,000 × 0.1 = $6,000.
After: SLE = $150,000 × 0.05 = $7,500; ALE = $7,500 × 0.1 = $750.
Net value: $6,000 − $750 − $2,400 = $2,850 per year. Yes, the control pays for itself, and it also protects against outages from hardware failure, which the calculation doesn't even count. Treatments: mitigate (a) and (b), mitigate (d) with updates and MFA on the website admin, and accept (c), since encryption already keeps its impact low.
Summary
- Risk management decides what to fix first by weighing likelihood and impact.
- The 5×5 matrix (score = likelihood × impact) produces a quick, visual heat map.
- ALE = SLE × ARO turns risk into dollars and shows whether a control pays for itself.
- Every risk is mitigated, transferred, avoided or accepted, and the decision is recorded in a risk register.
- NIST CSF 2.0 organizes a program into Govern, Identify, Protect, Detect, Respond and Recover, with profiles to measure gaps and tiers to describe maturity.
Next lesson: Web Security and the OWASP Top 10 (Conceptual). You'll learn the ten most critical web application risks in the 2025 edition and the questions to ask about any website or app you run.
Create your account in 30 seconds, mark your lessons and download your certificate at the end.