Risk recommendation
A fictional decision-ready statement explaining what should be done about a defined risk, why, by whom, by when, under what conditions, and how success will be validated.
High School IntermediateModule I17Lesson 5 of 8Risk Recommendation
I17.5 Creating a Risk Recommendation
Convert fictional technical evidence into a proportionate, decision-ready risk recommendation that explains likelihood, impact, controls, options, ownership, implementation, validation, communication, and residual risk.
Lesson Progress
Creating a Risk Recommendation
High School Intermediate • I17: Intermediate Capstone and Portfolio • Lesson 5 of 8
63% complete
Readiness Check
Before You Start
0/5 ready
Professional Hook
The Highest Technical Score Is Not Always the Best First Business Decision
A fictional dashboard marks a storage policy, telemetry gap, phishing message, and web authorization issue High. Treating every item the same could cause broad shutdown, unnecessary account resets, or ignored dependencies. A professional recommendation explains what matters, what is confirmed, which treatment is proportionate, and how the outcome will be validated.
Weak recommendation
Copy severity, assume worst-case impact, present one option, ignore continuity, assign no owner, set no deadline, and treat ticket closure as success.
Professional recommendation
Define the asset, write the risk statement, assess likelihood and impact, compare options, select proportionate treatment, assign owners, preserve continuity, validate, and state residual risk.
Objective 1
Define a fictional risk-recommendation purpose, audience, asset, business service, threat, weakness, control state, evidence boundary, privacy rule, owner, decision authority, and time horizon.
Objective 2
Translate fictional technical findings into clear risk statements that separate likelihood, impact, control effectiveness, uncertainty, potential harm, confirmed harm, and residual risk.
Objective 3
Compare fictional treatment options such as avoid, reduce, transfer, accept, defer, monitor, compensate, or combine controls without assuming the highest technical severity always determines business priority.
Objective 4
Write proportionate fictional recommendations with rationale, owner, authority, priority, deadline, dependencies, continuity considerations, rollback, success measures, validation, communication, and residual risk.
Objective 5
Produce a complete fictional risk-recommendation package with evidence, scoring rationale, assumptions, alternatives, decision criteria, implementation plan, validation plan, leadership summary, reflection, and portfolio-safety statement.
Why This Matters
Risk Recommendations Connect Technical Evidence to Authorized Business Action
Fictional analysts may identify the condition, but risk owners, service owners, control owners, suppliers, leadership, and recovery teams decide and perform different parts of treatment. The recommendation must make those boundaries, tradeoffs, timelines, and validation requirements visible.
Core Concept
Use the Asset–Threat–Weakness–Impact–Treatment Model
Asset
Which fictional system, service, identity, data, supplier relationship, process, or mission outcome has value?
Threat
Which fictional event, misuse, failure, dependency, or condition could create harm?
Weakness
Which fictional access, configuration, process, source, control, design, or validation gap makes harm more plausible?
Impact
Which fictional confidentiality, integrity, availability, privacy, operational, policy, trust, or mission consequences are possible or confirmed?
Treatment
Which fictional avoid, reduce, transfer, accept, defer, monitor, compensate, or combined option is proportionate and how will it be validated?
Key Vocabulary
Risk, Treatment, Ownership, and Validation Terms
Risk statement
A fictional sentence connecting an asset or service, harmful event, weakness, possible consequence, and business impact.
Asset
A fictional system, identity, service, dataset, process, supplier relationship, reputation, capability, or mission outcome that has value.
Threat
A fictional event, actor, condition, failure, misuse, error, or dependency that could cause harm.
Weakness
A fictional control gap, excessive access, insecure configuration, missing process, source-health issue, design flaw, or unvalidated state.
Likelihood
A fictional estimate of how plausible or frequent the harmful event may be within a defined time horizon and evidence boundary.
Impact
A fictional estimate of harm to confidentiality, integrity, availability, privacy, safety, operations, finance, compliance, trust, or mission.
Inherent risk
The fictional risk level before considering relevant controls or treatments.
Control effectiveness
A fictional assessment of whether a control is designed appropriately, operating as expected, monitored, validated, and sufficient for the risk.
Residual risk
The fictional risk or uncertainty remaining after controls, corrective action, monitoring, validation, or accepted limitation.
Risk owner
The fictional role accountable for deciding how the risk is treated and whether residual risk is accepted.
Control owner
The fictional role responsible for implementing, operating, monitoring, and validating a specific control.
Risk treatment
A fictional choice to avoid, reduce, transfer, accept, defer, monitor, compensate, or combine actions for a risk.
Compensating control
A fictional alternate safeguard that reduces risk when the preferred control cannot be implemented immediately.
Decision criteria
The fictional evidence, thresholds, service constraints, policy needs, cost, time, dependencies, and residual-risk limits used to select an option.
Validation measure
A fictional test, metric, owner signoff, effective-state check, service-health result, monitoring result, or review confirming whether the treatment worked.
Risk Components
Eight Components of a Decision-Ready Risk Recommendation
Asset and business context
Risk question
What fictional system, service, identity, data, supplier relationship, or mission outcome matters?
Strong approach
Name the asset, classification, business purpose, owner, dependency, users, criticality, and recovery expectation.
Weak approach
Use a vague label such as important server.
Evidence needed
Service catalog, owner statement, architecture, data classification, dependency map, or recovery objective.
Decision value
Shows that risk begins with business value rather than a technical score.
Threat or harmful event
Risk question
What fictional event, failure, misuse, dependency, or condition could cause harm?
Strong approach
Describe the event neutrally without assuming intent or a specific actor unless evidence supports it.
Weak approach
Use a dramatic threat label that already assumes compromise.
Evidence needed
Alert, scenario, incident pattern, supplier dependency, process failure, or control-state evidence.
Decision value
Demonstrates evidence-limited threat reasoning.
Weakness or exposure condition
Risk question
Which fictional control gap makes the event more plausible or impactful?
Strong approach
Describe the exact unsupported access, configuration, process, source, design, or validation gap.
Weak approach
State only that security is weak.
Evidence needed
Configuration history, role map, policy review, test result, source-health record, or owner confirmation.
Decision value
Connects technical evidence to the risk mechanism.
Likelihood
Risk question
How plausible is the fictional harmful event within the stated time horizon?
Strong approach
Use exposure, activity, frequency, control state, opportunity, dependency, and uncertainty.
Weak approach
Copy a scanner score directly into the likelihood field.
Evidence needed
Activity records, exposure state, historical frequency, control coverage, user interaction, and source limitations.
Decision value
Shows a transparent, reviewable likelihood rationale.
Impact
Risk question
What fictional harm could occur and what harm is already confirmed?
Strong approach
Separate potential impact, confirmed impact, service effect, data effect, user effect, financial effect, policy effect, and trust effect.
Weak approach
Describe the worst possible outcome as current fact.
Evidence needed
Service health, access evidence, data classification, owner input, user interaction, and validation results.
Decision value
Demonstrates accurate impact language.
Control effectiveness
Risk question
Which fictional controls exist and how well are they operating?
Strong approach
Separate expected, observed, failed, corrected, compensating, monitored, and validated states.
Weak approach
Assume a control is effective because it appears in a policy or diagram.
Evidence needed
Configuration, test results, logs, monitoring, owner review, exception status, and validation.
Decision value
Shows why control existence and control effectiveness differ.
Treatment options
Risk question
Which fictional options could avoid, reduce, transfer, accept, defer, monitor, compensate, or combine treatment?
Strong approach
Compare benefit, limitation, owner, authority, continuity, time, dependency, rollback, and residual risk.
Weak approach
Present one option without alternatives or tradeoffs.
Evidence needed
Technical feasibility, business constraints, owner input, service dependencies, policy, and implementation estimates.
Decision value
Demonstrates balanced decision support.
Recommendation and validation
Risk question
Which fictional option is preferred and how will the organization know it worked?
Strong approach
State rationale, owner, authority, priority, deadline, implementation, rollback, success measures, monitoring, and residual risk.
Weak approach
Write improve security or fix immediately.
Evidence needed
Decision criteria, owner approval, action plan, effective-state checks, service tests, metrics, and signoff.
Decision value
Turns analysis into accountable action.
Treatment Options
Eight Fictional Ways to Treat Risk
Avoid
Meaning
Stop the fictional activity, remove the service, eliminate the dependency, or redesign the process so the risk source no longer exists.
Best when
Best when the activity is unnecessary or cannot be reduced to an acceptable level.
Evidence needed
Business need, alternatives, service impact, owner authority, migration plan, and validation.
Tradeoff
Tradeoff: may remove capability, increase transition cost, or create a new dependency.
Reduce
Meaning
Lower fictional likelihood or impact through access changes, secure configuration, monitoring, segmentation, training, or process improvement.
Best when
Best when practical controls can reduce risk while preserving the required service.
Evidence needed
Control design, owner, implementation plan, rollback, service test, monitoring, and success measure.
Tradeoff
Tradeoff: controls can create complexity, delay, user friction, or operational dependency.
Transfer
Meaning
Shift part of fictional financial, contractual, operational, or service responsibility to another party while retaining oversight.
Best when
Best when a supplier, insurer, managed service, or contract can absorb defined responsibilities.
Evidence needed
Contract terms, shared responsibility, supplier capability, monitoring, escalation, and exit plan.
Tradeoff
Tradeoff: accountability, reputation, compliance, and some technical responsibility remain.
Accept
Meaning
Formally retain fictional residual risk because treatment cost, feasibility, timing, or business need supports the decision.
Best when
Best when residual risk is within approved tolerance and the correct owner accepts it knowingly.
Evidence needed
Risk statement, alternatives, rationale, owner authority, expiration, monitoring, and review triggers.
Tradeoff
Tradeoff: the organization remains exposed and must monitor conditions that could change the decision.
Defer
Meaning
Postpone fictional treatment to a defined date because of dependency, maintenance window, service constraint, or competing priority.
Best when
Best when immediate treatment would create greater harm and a controlled delay is supportable.
Evidence needed
Reason, owner approval, deadline, compensating controls, escalation triggers, and reassessment.
Tradeoff
Tradeoff: risk remains active during the delay.
Monitor
Meaning
Continue fictional evidence collection and threshold-based review when uncertainty is high or conditions are stable but unresolved.
Best when
Best when current evidence does not justify disruptive treatment and monitoring can detect meaningful change.
Evidence needed
Signals, thresholds, source health, owner, cadence, response trigger, and closure condition.
Tradeoff
Tradeoff: monitoring alone does not reduce the underlying weakness.
Compensate
Meaning
Use a fictional alternate safeguard when the preferred control cannot be implemented immediately.
Best when
Best when the substitute meaningfully reduces likelihood or impact and can be validated.
Evidence needed
Control mapping, limitation, owner, expiration, test results, monitoring, and replacement plan.
Tradeoff
Tradeoff: alternate controls may be narrower, manual, or less durable.
Combine
Meaning
Use several fictional treatments together because no single action addresses the full risk.
Best when
Best when risk spans identity, configuration, process, supplier, monitoring, and communication dimensions.
Evidence needed
Integrated plan, owners, authority, milestones, dependencies, rollback, metrics, and residual risk.
Tradeoff
Tradeoff: combined plans require stronger sequencing, ownership, and validation.
Recommendation Architecture
Eight Sections of a Professional Fictional Recommendation
1. Recommendation title and decision
State the fictional action requested in one clear sentence.
Include
Include the risk name, preferred treatment, owner, priority, and decision deadline.
Avoid
Avoid vague titles such as improve security.
2. Risk statement
Connect the fictional asset, harmful event, weakness, consequence, and business impact.
Include
Include asset, event, weakness, possible consequence, business effect, time horizon, and evidence boundary.
Avoid
Avoid unsupported actor attribution or worst-case impact stated as fact.
3. Evidence and assumptions
Explain the fictional records supporting the risk and uncertainty affecting confidence.
Include
Include evidence identifiers, source health, owner statements, confirmed facts, assumptions, alternatives, gaps, and limits.
Avoid
Avoid technical volume without relevance.
4. Likelihood and impact rationale
Explain how fictional likelihood and impact were estimated.
Include
Include exposure, activity, control state, criticality, data, service, users, policy, trust, and uncertainty factors.
Avoid
Avoid copying one technical score into the entire risk rating.
5. Current and residual risk
Separate fictional inherent risk, current controls, current residual risk, and expected post-treatment residual risk.
Include
Include controls, effectiveness, gaps, compensating controls, monitoring, validation, and tolerance.
Avoid
Avoid claiming zero risk after treatment.
6. Treatment comparison
Compare fictional alternatives fairly.
Include
Include benefits, limitations, continuity, time, owner, dependencies, rollback, and residual risk.
Avoid
Avoid presenting only one option or weakening alternatives unfairly.
7. Preferred recommendation
Explain why the selected fictional treatment is proportionate.
Include
Include rationale, owner, authority, priority, scope, deadline, sequence, rollback, communication, and residual risk.
Avoid
Avoid vague action language or unsafe real-system instructions.
8. Implementation, validation, and review
Define how the fictional treatment will be completed, proven effective, communicated, and reassessed.
Include
Include milestones, owners, service tests, effective-state checks, source health, metrics, signoff, residual risk, and review date.
Avoid
Avoid treating ticket completion as validation.
Risk Workflow
Eight Steps from Evidence to Approval
Define the risk question
Identify the fictional asset, service, owner, decision, time horizon, scope, evidence, privacy boundary, and threshold.
Output: Risk-review charter.
Validate evidence
Register fictional technical, business, owner, service, source-health, control, user, supplier, and validation evidence with limitations.
Output: Evidence and assumption register.
Write the risk statement
Connect fictional asset, harmful event, weakness, possible consequence, business impact, and uncertainty without overstating harm.
Output: Risk statement.
Assess likelihood and impact
Use fictional exposure, activity, control state, criticality, continuity, data, users, policy, trust, and uncertainty.
Output: Risk rationale.
Compare treatment options
Evaluate fictional avoid, reduce, transfer, accept, defer, monitor, compensate, and combined options with tradeoffs.
Output: Treatment comparison.
Write the recommendation
State fictional preferred action, rationale, owner, authority, priority, deadline, dependencies, sequence, rollback, and residual risk.
Output: Decision-ready recommendation.
Plan implementation and validation
Define fictional milestones, owners, service tests, effective-state checks, metrics, monitoring, signoff, and review triggers.
Output: Implementation and validation plan.
Communicate, approve, and review
Tailor fictional technical, service, leadership, supplier, user, and portfolio summaries, record the decision, and schedule reassessment.
Output: Approved risk package and reflection.
Fake Dashboard
Fake Northbridge Risk Recommendation Dashboard
Training dashboard for fictional risk decisions only.
Current priority risks
3
Unsupported supplier access, broad confidential-storage access, and monitoring-source weakness require coordinated treatment.
Preferred treatment
Combined
Targeted immediate correction plus ninety-day automation, monitoring, governance, and review improvements.
Expected residual risk
Moderate
Immediate control states are corrected while recurrence, source coverage, and process improvements remain under review.
Fake SOC Alert
Draft Recommendation Proposes Broad Shutdown without Proportionate Evidence
Source: Fake Northbridge Risk Review Console • Time: 1:42 PM
A fictional draft recommends disabling the entire support service even though services remain stable, confirmed harm is limited, and targeted reversible corrections are available.
Defensive recommendation: Compare meaningful options, preserve continuity, select targeted immediate correction plus longer-term improvements, assign owners and deadlines, define rollback and validation, and state residual risk.
Fake Log Panel
Fake Risk Recommendation Timeline
training-log-viewer.log
09:00 SCOPE asset='support-service' 09:15 EVIDENCE supplier-access='unsupported' 09:30 EVIDENCE storage-policy='broad-read' 09:45 EVIDENCE audit-source='gap' 10:00 IMPACT confidentiality='possible' 10:15 IMPACT service='stable' 10:30 OPTION shutdown='disproportionate' 10:45 OPTION monitor-only='insufficient' 11:00 OPTION targeted-correction='preferred' 11:15 OPTION combined-plan='preferred-full' 11:30 OWNER risk='assigned' 11:45 PLAN milestones='defined' 12:00 VALIDATION measures='defined' 12:15 COMM leadership='drafted' 12:30 REVIEW residual-risk='moderate' 12:45 DECISION recommendation='ready'
Training note: this is fake data for defensive analysis practice only.
Risk Findings
Seven Fictional Risk Findings
NBR-RSK-F01High
The fictional supplier-access condition creates a high current likelihood of unauthorized capability but does not prove malicious use.
Evidence support
Expired approval, active administrative identity, post-expiration sign-in, ended project, and no current business need.
Alternate explanation
An undocumented emergency support need may have existed.
Impact
Unsupported capability could affect confidential service data or configuration; misuse and disclosure remain unconfirmed.
Next action
Remove access, review sessions and activity, and require future narrow time-limited approval.
NBR-RSK-F02High
The fictional broad storage policy creates high potential confidentiality impact with incomplete evidence of actual access.
Evidence support
Confidential classification, broad-read condition, outside-window change, no approved exception, and limited access coverage.
Alternate explanation
A legitimate temporary sharing need may have existed but was not recorded.
Impact
Possible exposure is supported; unauthorized access and disclosure are unconfirmed.
Next action
Restore approved access, review covered evidence, add drift detection, and improve source coverage.
NBR-RSK-F03High
The fictional telemetry gap increases uncertainty and weakens monitoring-control effectiveness.
Evidence support
Thirty-eight-minute delivery gap, privileged coverage, compensating records, source recovery, and delayed evidence.
Alternate explanation
A nonsecurity delivery failure may explain the outage.
Impact
Monitoring assurance was reduced; harmful activity during the gap is unconfirmed.
Next action
Add failover, delay alerting, gap reconstruction, source-coverage review, and closure guidance.
NBR-RSK-F04Medium-High
The fictional phishing scenario supports targeted identity treatment rather than broad account reset.
Evidence support
High-confidence malicious message, one click, no reported credential entry, and no confirmed compromise.
Alternate explanation
The user may have entered information but failed to remember or report it.
Impact
Credential theft was possible; one click is confirmed while compromise remains unconfirmed.
Next action
Complete targeted identity review, remove related messages, guide the user, and monitor defined indicators.
NBR-RSK-F05High
The fictional web authorization gap requires targeted role correction and related access review.
Evidence support
Support role reached a manager-only route, no approved exception existed, and corrected role tests passed.
Alternate explanation
Documentation may have been outdated, but the owner confirmed the intended restriction.
Impact
Unauthorized page view is confirmed; modification and wider disclosure are unconfirmed.
Next action
Maintain route restriction, review inherited mappings, and add automated authorization tests.
NBR-RSK-F06High
The preferred fictional recommendation is a combined treatment plan rather than broad shutdown or monitoring alone.
Evidence support
Confirmed access and configuration weaknesses, stable services, reversible targeted actions, and open process improvements.
Alternate explanation
Broad shutdown could reduce technical exposure faster but would create disproportionate operational harm.
Impact
Poor treatment could leave serious gaps active or unnecessarily interrupt service.
Next action
Approve targeted immediate controls plus ninety-day automation, monitoring, governance, and review improvements.
NBR-RSK-F07Medium-High
The fictional residual risk is moderate after validation and should remain under monitored owner review.
Evidence support
Access, policy, route, source, user, and service validation passed while recurrence and process improvements remain open.
Alternate explanation
New evidence or failed monitoring could increase the rating.
Impact
Immediate unsupported states are corrected, but sustainable prevention is not yet fully implemented.
Next action
Maintain monitoring, complete milestones, and reassess at thirty, sixty, and ninety days.
Analyze the Evidence
Which Treatment Is Most Proportionate?
The fictional supplier access is unsupported and currently unnecessary.
The fictional storage policy creates possible exposure but no confirmed disclosure.
The fictional web route has an authorization gap.
The fictional audit source has recovered but needs stronger failover.
The fictional services remain stable and business-critical.
Targeted reversible corrections and long-term improvements are available.
Which recommendation is strongest?
Common Mistakes
Mistakes That Weaken a Fictional Risk Recommendation
Using a fictional scanner score, alert severity, or technical label as the entire risk assessment.
Writing a risk statement without naming the asset, harmful event, weakness, consequence, or business impact.
Treating malicious intent, unauthorized access, disclosure, or compromise as confirmed without evidence.
Ignoring service continuity, users, suppliers, time, dependencies, and operational constraints.
Presenting only one treatment option and hiding meaningful alternatives.
Choosing broad shutdown when targeted reversible treatment can reduce risk safely.
Choosing monitoring alone while confirmed high-impact control weaknesses remain active.
Treating a compensating control as permanent without expiration, limitation, owner, monitoring, or replacement plan.
Writing vague recommendations without owner, authority, priority, deadline, dependencies, rollback, validation, or residual risk.
Treating ticket completion as proof that treatment worked.
Claiming zero residual risk after correction.
Using the same detail for technical teams, service owners, leadership, suppliers, users, and portfolio reviewers.
Copying or lightly editing real risk registers, internal findings, systems, supplier records, logs, employee data, school records, or confidential material.
Turning the recommendation into instructions for accessing, testing, changing, or probing real systems.
Safe Practice Lab
Build the Northbridge Fictional Risk Recommendation Package
Your fictional assignment
Risk Statement, Evidence, Options, Recommendation, Implementation, and Validation
Use only the supplied fictional Northbridge evidence to create a complete decision-ready recommendation for technical, service, leadership, and portfolio audiences.
Required deliverables
- Risk-review charter with purpose, audience, asset, service, owner, decision, time horizon, scope, privacy, and threshold.
- Evidence and assumption register with relevance, source health, facts, alternatives, gaps, and limitations.
- Risk statement linking asset, harmful event, weakness, possible consequence, business impact, and evidence boundary.
- Likelihood, impact, inherent-risk, control-effectiveness, current-residual-risk, and post-treatment-residual-risk rationale.
- Meaningful treatment comparison covering avoid, reduce, transfer, accept, defer, monitor, compensate, and combine.
- Preferred recommendation with rationale, owner, authority, priority, deadline, dependencies, continuity, rollback, and communication.
- Implementation and validation plan with milestones, effective-state checks, service tests, source health, metrics, monitoring, and signoff.
- Technical summary, service summary, leadership brief, owner decision, reflection, revision history, and portfolio-safety statement.
Use only fictional and privacy-safe material. Do not copy, lightly edit, expose, or recreate real risk registers, company findings, systems, identities, supplier records, screenshots, logs, employee data, school records, incidents, or confidential recommendations.
Scenario Decision Lab
Leadership Requests Immediate Full Shutdown
The fictional service is stable, confirmed harm is limited, and targeted reversible corrections can reduce current access and configuration risk.
Scenario Decision Lab
The Corrective Tickets Are Complete
Fictional access, policy, and route changes are recorded, but effective state, source health, service function, owner signoff, monitoring, and residual risk still require validation.
Defender Habits
Creating a Risk Recommendation Checklist
Check Your Understanding
I17.5 Mini Quiz: Creating a Risk Recommendation
Choose your answers first. Explanations appear only after submission.
1. What makes a fictional risk statement complete?
2. Why should technical severity not determine the entire fictional business priority?
3. What is the strongest fictional treatment when unsupported access exists and services remain stable?
4. What does a compensating control require?
5. What makes a fictional recommendation actionable?
6. When should fictional residual risk be reassessed?
7. What makes a fictional risk recommendation portfolio-safe?
Portfolio Prompt
Portfolio Prompt
Create a fictional Northbridge Risk Recommendation Package. Include the review charter, asset and service context, owner and authority map, risk statement, evidence register, assumptions, alternatives, likelihood rationale, impact rationale, inherent risk, current controls, control effectiveness, current residual risk, treatment comparison, preferred recommendation, implementation plan, dependencies, continuity, rollback, validation measures, metrics, monitoring, communication plan, owner decision, post-treatment residual risk, reassessment schedule, technical summary, leadership brief, reflection, revision history, and a portfolio-safety statement.
Use only fictional assets, systems, identities, suppliers, evidence, dates, findings, decisions, actions, and outcomes.
Do not copy a technical severity score into the entire business-risk decision.
Compare meaningful options and explain why the preferred treatment is proportionate.
Show why completed actions, validated outcomes, accepted residual risk, and zero risk are different ideas.
Key Takeaways
What You Should Remember
1.Risk recommendations connect fictional technical evidence to authorized business decisions.
2.A complete risk statement identifies the asset, harmful event, weakness, consequence, impact, time horizon, and evidence boundary.
3.Technical severity is only one input to likelihood, impact, priority, continuity, and treatment.
4.Strong recommendations compare meaningful treatment options and explain tradeoffs.
5.Every recommendation needs an owner, authority, deadline, dependencies, rollback, validation, monitoring, and residual-risk statement.
6.Ticket completion is not the same as treatment effectiveness.
7.Portfolio risk artifacts must be fully fictional and should never expose or recreate real internal risk information.
Navigation