Information Security Risk Management for ISO 27001/ISO 27002, third edition

CHAPTER 12: LIKELIHOOD

Each of the preceding stages of the risk assessment has a relatively high degree of certainty about it. The vulnerabilities should be capable of technical, logical or physical identification. The way threats might exploit them should also be mechanically demonstrable. Defined scenarios have predictable consequences. The decisions that have to be made are those that relate to the actions the organisation will take to counter those threats. Before that, however, there needs to be an assessment as to the likelihood of the event, and what the appropriate response to it will be. This means that the actual risks have now to be assessed and related to the organisation’s overall ‘risk appetite’ – that is, its willingness to take ...