Inherent Risk
What is Inherent Risk?
The level of risk present in an activity or process before any controls or mitigating actions are applied, representing the natural risk exposure.
Terms that appear alongside inherent risk
Each of these is named in at least one of the same controls as inherent risk. The number is how many controls name both.
- remediation 5 shared controls
- risk assessment 4 shared controls
- cybersecurity 3 shared controls
- resilience 2 shared controls
- policy 2 shared controls
- security officer 2 shared controls
- maturity assessment 2 shared controls
- risk acceptance 2 shared controls
Frameworks that govern inherent risk
What the standards actually require on inherent risk
Requirements naming inherent risk across 6 standards, quoted from the control text.
The overall inherent risk level is generally the level with the most criteria rated, adjusted with documented rationale for the nature and complexity of products and services, size, business model and customer base;
hkma-cyber-resilience-assessment-framework-c-raf::IRA.2 · Overall inherent risk level and the minimum required maturity →In identifying and assessing inherent risk the bank reckons the technologies adopted, alignment with business and regulatory requirements, organisational culture, and internal and external threats.
rbi-cybersecurity-framework-for-banks::44 · Para 44: inherent risk factors reckoned →Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
NIST-CSF-ID.RA-05 · Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization →The outsourcer selects the questionnaire from the SIG Manager content library according to the inherent risk of the product or service being assessed.
sig-shared-assessments::U1 · Scope each SIG to the third party's inherent risk: SIG Lite, SIG Core or a custom SIG →A formal process updates policies whenever the institution's inherent risk profile changes.
ffiec-cybersecurity-assessment-tool-cat::D1.G.SP.E.3 · D1.G.SP.E.3 Strategy/Policies (Evolving 3) →Management develops risk measurement processes that evaluate inherent risk and the risk of different threats and uses the results to guide the selection of mitigating controls, drawing on threat analysis tools such as event trees, attack trees, kill chains and...
ffiec-it-examination-handbook::IS-II.B · II.B Risk Measurement (Information Security) →Questions people ask about inherent risk
What is Inherent Risk?
Why is Inherent Risk important for compliance?
Which compliance frameworks address Inherent Risk?
Where can I learn more about Inherent Risk?
See how Inherent Risk applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.