Risk exposure
Risk exposure is a leading measure.
What the published 2016 guidance says
Risk exposure is a leading measure. It counts the high and medium risks above the accepted threshold, and the high and medium risks with no recent status update. The threshold is defined in advance, and responsible parties are alerted when it is crossed. The target is one, meaning the defined position is met. Evidence is the current risk register. Collection and reporting are at least quarterly. Security staff own and collect the data, and the result shows how the high-risk count moves and how the count of accepted higher risks moves.
What it means in practice
Risk exposure is a leading measure: high and medium risks beyond the threshold, and risks with no recent status update. The register is the data source. The measure works only if the threshold and the review interval are defined before the count is taken.
Status of this record. For B.5, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Set the risk threshold and the status-update interval before counting. Keep the register current. Report the high and medium risks beyond threshold and the risks without a recent update, with the owner for each.
Evidence an assessor asks for
- Risk managementRisk register with status update dates
- Risk managementThreshold definition and alert records
- Risk managementTrend charts of high and of accepted high and medium risks
The question an assessor will ask
An assessor will ask for risk register with status update dates. The test for B.5 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Risk register with no last-review date per risk
- Accepted high risks not distinguished from treated ones
Before the next review
Before the next review, test this against one live record: risk register with no last-review date per risk.
What to check when the revision publishes
When DIS 27004 is published, compare the B.5 Risk exposure record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.