GB/T 20984-2022Information security technology—Risk assessment method for information security (English PDF)

3.1 Terms and definitions

The terms and definitions defined in GB/T 25069 and the following ones apply to this document.

3.1.1 Information security risk

The potential for a particular threat to exploit the vulnerability of a single or group of assets and the damage that this may cause to an organization.

3.1.2 Risk assessment

The entire process of risk identification, risk analysis, and risk evaluation.

3.1.3 Organization

An individual or group that has its own responsibilities, authority, and relationships to achieve its goals.

Note: The concept of organization includes, but is not limited to, a sole proprietor, company, legal person, firm, enterprise, agency, partnership, charity or institution, or parts or combinations thereof, whether incorporated or not, public or private. [Source: GB/T 29246-2017, 2.57, modified]

4.1 Relationship between risk factors

The relationship between the basic factors in risk assessment is shown in Figure 1.The basic factors of risk assessment include asset, threat, vulnerability, and security control. Risk assessment is carried out based on the above factors.

4.2 Principles of risk analysis

The principles of risk analysis are as follows.

4.3 Risk assessment process

The implementation process of risk assessment is shown in Figure 2.The risk assessment process shall include the following.

5.1 Preparation of risk assessment

Organization's implementation of risk assessment is a strategic consideration. Its results will be affected by organizational planning, business, business process, security requirement, system scale and structure, etc. Therefore, before the implementation of risk assessment, the following work shall be prepared.

5.2 Risk identification

5.2.2 Threat identification

5.2.2.1 Content of threat identification

The content of threat identification includes the source, subject, type, motivation, timing, and frequency of the threat.

5.2.4 Vulnerability identification

5.2.4.1 Content of vulnerability identification

If vulnerabilities do not have a corresponding threat, controls do not need to be implemented; but they shall be noted and monitored for changes. Conversely, if a threat does not have a corresponding vulnerability, it does not lead to a risk. It shall be noted that unreasonable implementation of controls, failure of controls, or misuse of controls are inherent vulnerabilities. Controls may or may not be effective depending on the environment in which they operate.

5.4 Risk evaluation

5.4.1 Evaluation of system asset risk

According to the risk evaluation criteria, the system asset risk calculation results are graded. Table 11 presents a grading method for system asset risk.

5.4.2 Evaluation of business risk

According to the risk evaluation criteria, the business risk calculation results are graded.

When conducting business risk evaluation, it can be analyzed from two aspects. Social impact and organizational impact. Social impact covers the aspects such as national security, social order, public interests, and the legitimate rights and interests of citizens, legal persons, and other organizations.

5.6.2 Risk assessment documents

Risk assessment documents refer to the process documents and result documents generated during the risk assessment process, including (but not limited to).

A.1 Overview

Risk assessment shall run through all stages of the assessment object lifecycle. The risk assessment principles and methods involved in each stage of the assessment object lifecycle are consistent. But due to the different implementation contents, objects, and security requirements in each stage, the risk assessment objects, purposes, requirements and other aspects are also different. In the planning and design stage, use risk assessment to determine the security objectives of the assessment object.