Risk Management

Risk Identification and One-Time Risk Assessments

Risk management begins with identification — recognizing that a weakness or exposure exists before it is exploited. Organizations that identify risks proactively can implement controls before harm occurs. Organizations that discover risks reactively typically do so after suffering the consequences. Risk management is therefore fundamentally a forward-looking discipline.

Risk Identification

Risk identification is the process of systematically finding weaknesses, threats, and vulnerabilities that could negatively impact the organization. Effective risk identification addresses both internal and external sources:

• Internal threats: Vulnerabilities within the organization's own systems, processes, and people. Examples: unpatched software, misconfigured systems, weak access controls, untrained employees, outdated hardware.
• External threats: Threats originating outside the organization that could exploit identified vulnerabilities. Examples: ransomware actors, phishing campaigns, supply chain compromise, regulatory changes that create compliance risk.
• Qualifying risk: Not all identified risks are treated the same. Risk identification includes qualifying each risk — assessing its potential severity and likelihood — so that limited resources can be directed toward the risks that matter most.
• Ongoing nature: Risk identification is not a one-time project. New systems are deployed, the threat landscape evolves, regulations change, and organizational processes shift. Risk identification must recur to remain relevant.

One-Time Risk Assessment

A one-time risk assessment is conducted for a specific, discrete event or project that has a defined beginning and end. Once the assessment purpose is fulfilled, it is not repeated (unless the triggering circumstance recurs).

• Company acquisition: When an organization acquires another company, they inherit all of that company's technology, data, processes, and security posture. A one-time risk assessment evaluates the security risks introduced by the acquisition: what systems does the target company have, what vulnerabilities exist, what compliance gaps need to be addressed, and what is the risk of integrating the two environments.
• New equipment deployment: Deploying a new type of equipment (a new industrial control system, a new medical device network, a new cloud platform) that has not been evaluated previously. The assessment determines what security controls are needed for that specific equipment type before it is integrated into the production environment.
• Unique threat investigation: A security team discovers evidence of a previously unknown attack technique targeting their specific industry. A one-time assessment determines whether the organization is vulnerable to that specific threat and what immediate controls are needed.
• Duration: One-time assessments have a defined scope and timeline. They are not ongoing monitoring — they are a focused snapshot of risk at a specific point in time for a specific purpose.

Ad Hoc and Recurring Risk Assessments

Ad Hoc Risk Assessment

An ad hoc risk assessment is performed for a specific, unique purpose that is not part of the regular assessment schedule. Unlike one-time assessments triggered by a project, ad hoc assessments typically respond to an emerging concern or specific organizational question that requires immediate attention.

• Formation and disbanding: For an ad hoc assessment, a committee or team is formed specifically for that purpose, performs the assessment, and then disbands when the assessment is complete. The committee does not continue as a permanent standing body.
• CEO concern scenario: A CEO returns from an industry conference where a new attack technique was discussed extensively — for example, a sophisticated supply chain attack targeting their industry. The CEO is concerned and requests an immediate assessment of the organization's exposure to this specific threat. An ad hoc team is formed, evaluates the specific risk, produces a report, and then disbands.
• Regulatory inquiry scenario: A regulator notifies the organization of a specific security control area they will be auditing. An ad hoc team is formed to assess the organization's compliance posture in that specific area before the audit.
• Distinction from recurring: Ad hoc assessments are not scheduled. They are triggered by specific, unplanned events or concerns. The key characteristic is: they are formed for one purpose, conducted, and then the team disbands.

Recurring Risk Assessment

A recurring risk assessment is performed on a defined schedule, repeating at regular intervals as part of the organization's ongoing security program. Unlike ad hoc assessments (triggered by events) or one-time assessments (triggered by specific projects), recurring assessments happen on a calendar, regardless of whether a specific incident triggered them.

• Schedules: Common recurring assessment intervals include quarterly, semi-annual, and annual. The frequency depends on the organization's risk profile, regulatory requirements, and available resources. Higher-risk organizations (financial institutions, healthcare) typically conduct more frequent assessments.
• Conducted by internal teams: Recurring assessments are typically conducted by internal security teams, using established assessment frameworks and processes. The consistency of using the same methodology each period allows meaningful comparison between assessment periods.
• Regulatory mandates: Many regulations specifically require recurring risk assessments on defined schedules. PCI DSS (Payment Card Industry Data Security Standard) requires an annual risk assessment as part of compliance. HIPAA requires an ongoing risk analysis (periodic, risk-based frequency). NIST frameworks recommend regular risk assessments as part of continuous monitoring programs.
• Trend analysis: Because recurring assessments use consistent methodology over time, they enable trend identification: is the organization's overall risk posture improving or worsening? Which risk categories are changing? What is the impact of security investments made since the last assessment?

PCI DSS Annual Risk Assessment

PCI DSS Requirement 12.3 specifically mandates that organizations perform a risk assessment at least annually and when significant changes occur to the environment. This is one of the most commonly cited examples of a regulatory mandate for recurring risk assessment:

• The assessment must identify critical assets, threats, and vulnerabilities
• Results must be documented and used to inform the organization's security program
• The annual assessment is a compliance checkpoint: QSA (Qualified Security Assessor) auditors will review the risk assessment documentation as part of PCI DSS validation

Continuous Risk Assessment and Change Control Integration

Continuous Risk Assessment

Continuous risk assessment is an ongoing process that integrates risk evaluation into every operational activity rather than treating risk assessment as a periodic event. Instead of taking snapshots of risk at intervals, continuous assessment maintains current awareness of the organization's risk posture in real time or near-real time.

• Ongoing process: Continuous assessment does not have a start and end date. It is woven into the fabric of how the organization operates. Security tools (SIEM, vulnerability scanners, EDR, threat intelligence feeds) contribute to a continuously updated picture of risk.
• Part of change control: The most important integration point for continuous risk assessment is the change management process. Every change to IT systems introduces potential new risks. Continuous assessment requires that a risk assessment be performed for every significant change before it is approved and implemented.
• Risk assessment in change control: When a change request is submitted to the Change Control Board (CCB), the assessment of risk associated with that specific change is part of the approval workflow. The CCB cannot meaningfully approve a change without understanding what new risks that change introduces. This applies to:
• New software deployments or upgrades
• Firewall rule changes
• Network architecture modifications
• Access control changes
• Third-party integrations
• Real-time visibility: Continuous assessment leverages automated tools to maintain current awareness: vulnerability scanners that continuously check for new vulnerabilities, threat intelligence feeds that alert to emerging attack techniques, SIEM systems that correlate events into risk indicators.

Comparison of Assessment Types

Why Risk Assessment Must Be Integrated with Change Control

Changes to IT systems are one of the primary sources of new risk introduction. A system that was assessed and found acceptable yesterday may have a new vulnerability today if a change was made without risk evaluation:

• A new firewall rule opens a port without assessing what services are exposed
• A software upgrade introduces a new dependency with known vulnerabilities
• A cloud migration moves data to a region with different regulatory requirements
• A third-party integration creates a new data sharing relationship not previously assessed

Each of these is a risk that would only be caught if risk assessment is part of the change control workflow. Organizations that conduct periodic risk assessments but skip change-control risk analysis create a gap where new risks accumulate between assessment periods without being identified or managed.