Risk Assessment
Description
Conduct risk assessments of the system; document risk assessment results; review and update assessments periodically.
⚠️ Risk Impact
Without documented risk assessment, control prioritization is opinion. Auditors test whether security activities are risk-driven or arbitrary. The latter produces qualified opinions.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.
🔧 Remediation
Annual formal risk assessment + continuous incremental risk review. Document threat sources, vulnerabilities, likelihood, impact, controls. Tie to risk register (CC3.2). Brief leadership on top risks.
💀 Real-World Attack Scenario
A federal contractor's risk assessment was 3 years old. The threat landscape had shifted dramatically (ransomware-as-a-service maturity, supply-chain attack normalization, deepfake fraud emergence) — none reflected in their controls. A ransomware attack exploited a vector their old risk assessment didn't anticipate. The post-incident review traced the gap directly to stale risk assessment.
💰 Cost of Non-Compliance
Stale risk assessments as breach contributor: 31% of major 2024 incidents (Mandiant M-Trends). FedRAMP RA-3 deficiencies: blocks ATO renewal.
📋 Audit Questions
- 1.When was the last formal risk assessment?
- 2.What threats does it cover? Are ransomware, supply chain, AI-enabled fraud included?
- 3.How is the assessment updated as threat landscape evolves?
- 4.Who reviews + approves the assessment?
⚡ Common Pitfalls
- ⛔Risk assessment as one-time annual document — irrelevant by month 4
- ⛔Generic threat library not tailored to your business + technology stack
- ⛔No leadership review — assessment exists but doesn't drive resource decisions
📈 Business Value
Living risk assessment is the navigation system for security investment. Without it, the security team is responding to fashion, not threat.
⏱️ Effort Estimate
40-80 hours annual formal assessment + 4 hours monthly incremental review
EchelonGraph derives risk signals from live workload + threat-intel data
🔗 Cross-Framework References
Automate NIST 800-53 RA-3 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →