Prioritize threats and residual risk

Prioritize decisions, not fear

Threat prioritization directs engineering and assurance effort. It should make assumptions and uncertainty visible rather than manufacture precise numbers unsupported by evidence.

Evaluate consistent factors

For each scenario, assess:

• Impact: consequence to people, mission, data, security, operations, finances, reputation, or obligations.
• Likelihood or feasibility: required capability, access, complexity, opportunity, and known exposure.
• Reach and scale: number of users, records, systems, tenants, devices, or downstream decisions affected.
• Detectability: probability and speed of reliable detection.
• Recoverability: ability and time required to contain, reverse, restore, and verify recovery.
• Existing control strength: design coverage, bypass paths, test evidence, and operational maturity.
• Uncertainty: missing architecture, threat, behavior, or incident data.

Use qualitative levels with defined criteria. Do not compare scores created from different definitions.

Distinguish inherent and residual risk

Inherent risk describes the scenario before considering controls. Residual risk describes what remains after specific implemented and verified controls.

Planned controls do not reduce current residual risk until implemented and tested. Record them as treatment actions.

Select a treatment

For every material scenario, choose and justify one or more treatments:

• Avoid the activity or remove the capability.
• Reduce likelihood, reach, or impact through controls.
• Transfer a defined responsibility through an accepted arrangement without pretending accountability disappeared.
• Accept the residual risk through the authorized owner.
• Investigate uncertainty before deciding.

Use Write effective control objectives for treatment requirements.

Residual-risk record

Scenario ID:
Inherent assessment and rationale:
Implemented controls and test evidence:
Residual assessment and uncertainty:
Treatment decision:
Authorized owner:
Conditions and expiration:
Monitoring and review trigger:
Recovery obligation:

Prioritization review

Challenge whether high-impact low-frequency scenarios were dismissed, whether privileged and supply-chain access was underestimated, and whether missing detection was incorrectly treated as low likelihood.

Reassess when intended purpose, data, models, tools, permissions, providers, interfaces, deployment boundaries, threat intelligence, incidents, or control evidence changes materially.