T01: Adopt a Risk-Based Approach

Effective security is not about eliminating all risk; it is about understanding which risks matter most and directing effort and investment accordingly.

Why This Tenet Matters #

Organisations operate with finite resources in an environment of near-infinite potential threats. A security function that attempts to address everything equally will inevitably address nothing adequately. A risk-based approach provides the intellectual and operational framework for making sound, defensible decisions about where to invest, what to prioritise, and what level of residual risk is acceptable given the organisation’s strategic objectives and risk tolerance. Without this discipline, security effort becomes reactive, inconsistent, and increasingly difficult to justify to the business leaders whose support the function depends upon.

Core Concepts #

Fundamental Shift From Maturity to Risk #

The risk-based approach represents a deliberate shift away from maturity-based security models, where success is measured by achieving predetermined capability levels, toward a framework in which every decision is grounded in the actual risk reduction it delivers. This distinction matters because maturity models can incentivise the completion of activities regardless of whether they address the organisation’s most pressing vulnerabilities, while a risk-based model keeps attention and resources focused on what genuinely threatens the business.

Risk, Threat, and Impact #

Information security risk is best understood as a form of operational risk, encompassing potential losses across financial, reputational, regulatory, and operational dimensions. A critical conceptual distinction underpins this tenet: information security risk refers to the potential impact of adverse events, while threats refer to the actual dangers that could cause them. Conflating the two leads to poorly calibrated responses. Managing risk effectively requires understanding both the likelihood and the consequence of specific threat scenarios, and prioritising action accordingly.

Embedding Security Risk in the Enterprise Risk Framework #

The risk-based approach also demands integration with the organisation’s broader Enterprise Risk Management framework, ensuring that information security risk is assessed and communicated in terms that are consistent with how the organisation understands and governs risk across all of its functions.