Identify and Analyze Risk
Description
The entity identifies risks to the achievement of its security objectives across the entity and analyzes them as a basis for determining how the risks should be managed.
⚠️ Risk Impact
Risk identification is only as useful as the depth of analysis. A risk register listing 'cyber attack' as a single line item generates no actionable insight — but neither does a 400-row register where everything is equally important.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.
🔧 Remediation
Maintain a structured risk register: per-workload identified risks, scored likelihood × impact, mapped to mitigation. Refresh quarterly. Tie to compliance findings: every Critical finding should be linked back to an identified risk + mitigation plan.
💀 Real-World Attack Scenario
A healthcare SaaS company's risk register listed '47 high-priority risks' but never prioritized them or assigned mitigation owners. When auditors asked 'show me how risk 14 has been addressed', the team couldn't. The audit found CC3.2 deficient and CC1.5 (accountability) as the supporting weakness — a cascade failure that produced two qualified opinions instead of one.
💰 Cost of Non-Compliance
Unowned risks as breach contributors: 51% of major 2024 breaches traced to risks identified pre-incident but unowned (Mandiant M-Trends 2024). Cascading SOC 2 findings (CC3 + CC1.5): increase remediation cost 2-3× vs single-finding remediation.
📋 Audit Questions
- 1.Show me the risk register. How many rows? When was the last review?
- 2.Pick three risks at random. Who owns them? What's the mitigation plan? Status?
- 3.How is risk likelihood × impact scored? Show the scoring rubric.
- 4.How do risks tie to specific compliance findings or controls?
⚡ Common Pitfalls
- ⛔Risk register as a one-time document that never gets re-evaluated as the business or environment changes
- ⛔Risks scored qualitatively only ('high'/'medium'/'low') without the supporting math — produces inconsistent prioritization
- ⛔No formal risk-acceptance documentation — risks linger in 'open' status indefinitely because nobody can close them without a paper trail
📈 Business Value
A maintained risk register that drives quarterly action is the strongest evidence of operating internal control. It moves the conversation from 'we identified the risk' to 'we identified, scored, owned, and managed the risk' — which is what auditors and regulators want to see.
⏱️ Effort Estimate
16-24 hours quarterly for risk register review + mitigation planning
EchelonGraph derives risks from live control state; auto-routes to documented owners; tracks aging
🔗 Cross-Framework References
Automate SOC 2 CC3.2 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →