We’ve previously discussed the role of risk assessment as defined by the International Organization of Standardization (ISO) 31000, and generally speaking, we’ve found that risk management is a key practice to supporting security and compliance. To better support organizations approaching risk assessment, ISO published the supplementary document, ISO/IEC 31010, “Risk assessment technique.”
In this article, we’ll provide a brief overview of the processes and techniques advocated by this publication.
What Is ISO/IEC 3101?
ISO 31010 is a risk management standard developed by the International Organization for Standardization (ISO). It provides guidelines on assessing and managing risk in an organization and is intended to be used with other ISO risk management standards, such as ISO 31000. This publication provides a framework for organizations to identify, assess, and manage risk using various risk assessment techniques.
ISO 31010 is designed to be flexible and can be applied to a variety of contexts and industries. The standard is intended to help organizations make informed decisions about risk management and to develop risk management strategies that are tailored to their specific needs and circumstances.
What Are the Risk Assessment Implementation Guidelines in ISO 31010?
Before providing the series of techniques that organizations can use for risk assessment, ISO 31010 includes guidelines on how to implement these techniques. Note that this implementation guide is meant to complement ISO 31000 guidelines on risk management and incorporate the techniques later defined in this document within that framework.
The general implementation guideline includes the:
- Assessment Planning: This process involves preparing the organization for its initial and ongoing risk assessments. These guidelines include defining the scope and purpose of the assessment, understanding the organizational context for assessing risk, including insight and expertise from SMEs within the organization, defining assessment objectives, establishing criteria for measuring risk, and understanding how social and human factors may impact both the assessment and ongoing risk management.
- Information Management: Collecting information is a critical part of risk assessment, and the methodologies employed to perform this task must align with the criteria and goals of the organization. Organizations should be able to source information (including determining reliability and category of information sources), analyze data within its historical lifecycle, and establish potential information uncertainties. In addition, the organization should model data and risk models at this point in its assessment process. Modeling data, in this context, means mapping problems, outcomes, and representations of processes into a model that makes the evaluation of inputs and outputs viable.
- Application of Assessment Techniques: This guideline guides how to determine sources of risk, identify risks, investigate the effectiveness of existing controls, and analyze the likelihood of risks. This guideline also directs organizations to follow techniques defined in Annex A and B of this document (described in more detail below).
- Analysis Review: Organizations should be able to verify and validate results from their risk assessment based on the models and metrics developed in the previous steps. This also includes working on any potential uncertainty that could shape the analysis of those results, such as system variables or unreliable data sources. Finally, organizations should use results to apply to decision-making.
- Application of Results Towards Decision-Making: Any decisions about measuring risks and their impact on a system, making determinations about acceptable risks, and selecting between different types of risk based on preferability should be informed by the described risk assessment process.
What Are the Risk Assessment Techniques Outlined in ISO 31010?
In line with its breakdown of a risk assessment process, ISO 31010 provides an appendix of specific techniques that an organization can use to follow through on its analysis. Additionally, these techniques are mapped explicitly into the risk assessment process defined in ISO/IEC 31000.
- Eliciting Insights from Stakeholders and Experts (B1): This family of techniques focuses on how to gather information from SMEs and other stakeholders in an accurate and effective way. Some techniques defined here include structured brainstorming, gaining a consensus from a group of experts (the Delphi technique), distributed 1-1 brainstorming sessions (Nominal group technique), interviews, and surveys.
- Identifying Risks (B2): This family of techniques emphasizes how the organization accurately gathers information on and identifies risks within its systems. These techniques include the use of classification and taxonomies, using Failure Modes and Effects (FMEA) and Failure Modes, Effects, and Criticality (FMCEA) Analysis, using Hazard and Operability (HAZOP) studies, scenario analysis, and Structured What-If Techniques (SWiFT).
- Determining Sources of Risk (B3): This family of techniques foregrounds the capacity of an organization to properly understand the causes of risks through the study of risk relationships. These techniques include analyzing intangible risk sources (Cindynic approach) and team-based causal analysis (Ishikawa analysis).
- Analyzing Controls (B4): This family of techniques emphasizes the organization’s ability to determine if controls are adequate and appropriate for identified risks. This includes bow-tie analysis, Hazard Analysis and Critical Control Points (HACCP), and Layers of Protection Analysis (LOPA).
- Understanding Consequences (B5): These techniques help the organization understand the more significant impact of risks depending on the context and history of the system. These techniques include Bayesian analysis, Bayesian Networks and Influence Diagrams, Business Impact Analysis (BIA), Cause-Consequence Analysis (CCA), Event Tree Analysis (ETA), Fault Tree Analysis (FTA), Human Reliability Analysis (HRA), Markov Analysis, Monte Carlo simulation, and Privacy Impact Analysis (PIA).
- Analyzing Dependencies (B6): This technique requires that the organization perform causal mapping or use chains of argument or logic showing the relationships between events, controls, and risks. This includes causal mapping and cross-impact analysis.
- Providing Measure of Risk (B7): These techniques provide ways to measure risk impact on systems or the wider public. These techniques include toxicological risk assessment, Value at Risk (VaR) assessment, and Conditional VaR.
- Evaluating Significance of Risk (B8): This family of techniques defines ways to determine how to treat risk within the organization’s context. This includes testing for the principle of “reasonably practicable” for risk toleration, using Frequency-Number (F-N) diagrams and Pareto charts, assessing based on Reliability-Centered, Maintenance (RCM), and using mapping risk indices.
- Selecting Between Options (B9): These techniques relate to the organization’s capability to make decisions between two more paths for risk management, including decisions regarding acceptable risk and implemented controls. These techniques will include Cost-Benefit Analysis (CBA), decision tree analysis, game theory, and Multi-Criteria Analysis (MCA).
- Recording and Reporting (B10): These techniques refer to the organization’s ability to record risk information into a database to provide insights into evolving risk potential and evaluation. These techniques will include risk registers, maintaining maintenance documents, and modeling with S-curves.
Why Is it So Important to Manage Risk Effectively?
Risk assessment helps organizations understand the potential impact of a cybersecurity breach and the likelihood of that breach occurring. Organizations can develop a plan to prevent, detect, and respond to cybersecurity incidents by identifying potential vulnerabilities and threats.
Additionally, risk assessments can help organizations allocate resources more effectively. Not all risks are created equal, and by assessing and prioritizing risks, organizations can focus their resources on the most critical areas of vulnerability.
Finally, many regulatory frameworks and standards, such as the GDPR and PCI DSS, require organizations to perform risk assessments as part of their compliance efforts. Failure to conduct risk assessments and mitigate identified risks can result in significant financial and reputational damage.
Some of the more general benefits of proper risk assessment include:
- Prioritize Security Measures: Risk assessment helps identify potential vulnerabilities and threats and rate them based on organizational priorities. Organizations can focus their resources on the most critical areas of vulnerability by understanding the likelihood and potential impact of a cybersecurity incident.
- Improve Compliance Efforts: Many regulatory frameworks and standards require organizations to perform risk assessments as part of their compliance efforts. Risk assessment can also help that organization better understand its security posture if it is optional.
- Enhance Collaboration: Risk assessment can help facilitate communication and collaboration between different stakeholders. By involving them in the risk assessment process, organizations can ensure everyone is on the same page regarding cybersecurity risks and strategies to mitigate them.
Put Risk Management at the Forefront of Your Security with Lazarus Alliance
Ready to seriously consider risk management as a priority of your organization? Planning on undergoing assessment for ISO 31000, implementing ISO 31010 techniques, or even pursuing ISO 27001 certification? Then work directly with the experts at Lazarus Alliance to help you through the process.
What Is Autonomous Malware?
We’re reaching the end of 2025, and looking ahead to 2026, most experts are discussing the latest threats that will shape the year ahead. This year, we’re seeing a new, but not unexpected, shift to autonomous threats driven by state-sponsored actors and AI. With that in mind, a new generation of threats, broadly known as...Continue reading→
What CISA’s Emergency Directive 26-01 Means for Everyone
In mid-October 2025, the CISA issued one of its most urgent orders yet: Emergency Directive 26-01. The directive calls on all Federal Civilian Executive Branch (FCEB) agencies to immediately mitigate vulnerabilities in devices from F5 Networks following a state-sponsored breach of F5’s systems and access to portions of BIG-IP source code and vulnerability data. The event...Continue reading→
Cybersecurity and Vetting AI-Powered Tools
A recent exploit involving a new AI-focused browser shone a light on a critical problem–namely, that browser security is a constant issue, and AI is just making that threat more pronounced. Attackers discovered a way to use that browser’s memory features to implant hidden instructions inside an AI assistant. Once stored, those instructions triggered unwanted...Continue reading→
Shutdown Security And Cyber Vulnerability
When the federal government shuts down, the public sees closed monuments, unpaid workers, and halted programs. What they do not see is the silent surge of cyberattacks targeting agencies already operating on fumes. During the most recent shutdown, attacks against U.S. government systems spiked by nearly 85%. Cybersecurity failures during government disruptions rarely start with...Continue reading→
Identity and the Shift from Malware
The world of cyber threats is rapidly evolving, and while we can see these changes more generally, it’s always crucial to understand them concretely. As the 2025 CrowdStrike Global Threat Report shows us, the landscape of our industry is changing. We’re digging into this report to discuss a challenging trend: the move of hackers foregoing...Continue reading→
Maintaining Compliance Against Prompt Injection Attacks
The increasing adoption of AI by businesses introduces security risks that current cybersecurity frameworks are not prepared to address. A particularly complex emerging threat is prompt injection attacks. These attacks manipulate the integrity of large language models and other AI systems, potentially compromising security protocols and legal compliance. Organizations adopting AI must have a plan...Continue reading→
Are We Already Talking About CMMC 3.0?
The ink has barely dried on the CMMC final rule, and already the defense contracting community is buzzing with speculation about what comes next. Just when contractors thought they had a moment to catch their breath after years of regulatory limbo, whispers of CMMC 3.0 have begun circulating through the industry. But is this just...Continue reading→
Centralizing Identity-Based Risk
As the traditional network boundary dissolves and remote work becomes standard practice, identities are the major frontier for security. Whether we’re talking about human users, service accounts, or machine identities, these have emerged as both the primary access mechanism and the most targeted attack vector. It has become imperative for providers to centralize identity management...Continue reading→
Deviation and Significant Change Requests in FedRAMP: A Comprehensive Guide
FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. While the program’s rigorous baseline requirements ensure consistent security, the reality is that this consistency calls for a little flexibility. This is where deviation requests and significant change requests come into play. These two...Continue reading→
The Costs of Compliance and Data Breaches
Data is possibly one of the most valuable assets any organization holds. Customer information, employee records, and proprietary business intelligence present challenges because the data flowing through modern enterprises represents both significant opportunities and serious risks. Businesses face a challenging balance: investing in compliance measures to protect sensitive information while also preparing for the real...Continue reading→
Related Posts