Risk is the foundation of security management. As security professionals, our primary role encompasses three key responsibilities:
- Develop an in-depth understanding of your business or organisation.
- Identify and manage security risks.
- Effectively communicate those risks to the business.
Risk management stands as the foundation of every security program. It is deeply embedded in numerous security standards and regulations. Yet it’s surprising how often its importance is misunderstood or overlooked.
What the standards say
To illustrate, here are some of the main regulations and guidelines in the security sector:
- Australian Handbook 167 (SA HB 167:2025): Advocates that security risk management is fundamentally rooted in a deep comprehension of risk management principles.
- ASIS Enterprise Security Risk Management: Emphasises a strategic approach to security management. It aligns an organisation’s security with its overall strategy, grounded in globally recognised risk management principles.
- ISO/IEC 27001 – Information Security Management: Mandates organisations to undertake a risk assessment to discern, evaluate, and navigate information security risks.
- National Institute of Standards and Technology (NIST): Offers directives on executing risk assessments for federal information systems and organisations.
In essence, most doctrines steering the implementation of physical and cyber security necessitate a thorough risk assessment.
What the profession says
At the Security Institute Annual Conference, the Institute’s Royal Patron, HRH The Princess Royal, aptly said in her speech that “Prevention requires an understanding of the risks, but the risk is changing.”
Brian Allen and Rachelle Loyear, renowned authors in the field of security risk management, concisely expressed, “It’s all about risk management”. In his celebrated SRMBOK, Julian Talbot aligns the practice of security risk management directly with ISO 31000 risk management guidelines.
Moreover, a thought-provoking paper by William Harris & Moufida Sadok posed a critical question. Despite wide academic support for a risk-centric approach to security, why do security professionals adopt it so inconsistently?
Change is happening
Rob Kennedy from the Protective Security Centre of the UK’s Home Office introduced a new Level 4 course, “The Fundamentals of Protective Security”, at a Security Institute conference. This course emphasises the foundational role of globally accepted risk guidelines. It also stresses a comprehensive approach to security, closing the gaps between physical, personnel, technical, and cyber security disciplines.
The three questions at the foundation of security management
A basic security risk assessment requires the security professional to answer three fundamental questions:
What are you protecting?
What are you protecting them from?
How vulnerable are they?
The foundation of effective security management is risk.
Failing to address these questions means you’re not doing risk and …
If you’re not doing risk, you’re not doing security.