Risk Management

Kind: activity

Layer: Security Core

Record: architecture:risk-management

Severity: contextual

Scope: architecture, security, delivery

Canonical: Ontology

The activity of identifying risks, rating their likelihood and impact, and assigning each one an owner and a mitigation.

Listed in Architecture principles, after Policy as Code and before Continuous Compliance.

Requires

• Risk Identification
• Mitigation

Reinforces

• Compliance
• Security by Design

Enables

• Priority-Based Controls

Conflicts with

• Unowned Risk

In tension with

• Speed

Tensions

• Risk Management / Speed

Violated by

• Unowned Risk

Refactored by

• Mitigation Plan
• Restrict Exports

Severity

• contextual

Category

• Security / Privacy / Compliance / Governance

Reinforced by

• Threat Modeling

Linked from

• Anti-patterns
• Security / Privacy / Compliance / Governance
• Architecture Review Evolution Governance
• Core Modular Design
• Security Privacy Compliance
• Severity levels
• The resolutions