While numerous standards and guidelines on Security Risk Management have emerged over the past 15 years, a surprising number of security professionals still don’t follow a standard security risk assessment approach. The absence of universally accepted terminology has obscured the distinctions between security reviews, audits and risk assessments, and even a common undertaking of the term ‘Risk‘.
“Why the hesitation among security professionals to adopt a standard approach?“
Research from Ireland highlights Standards Australia’s SA HB 167:2025 Security Risk Management Handbook as the most frequently referenced source for security risk management. The 2025 edition widens its scope to security-related risk across physical, cyber, people and information.
So, to further promote a cohesive approach to Security Risk Assessments (SRA), let’s distil its core elements concisely.
A comprehensive security risk assessment should address three pivotal questions:
What are you trying to protect?
What are you trying to protect from?
How vulnerable is it?
This framework is equally pertinent for both physical and cyber security risk assessments, bridging the divide between the two areas.
“A security risk assessment that doesn’t tackle these queries is incomplete”
What are you trying to protect?
A competent security professional must identify what they are tasked to protect. The first step involves identifying the assets essential to the business and prioritising them. Creating this list of assets, sometimes termed a criticality assessment, is foundational for subsequent analyses.
Essential assets typically encompass:
- People: Employees and stakeholders.
- Physical Assets: Infrastructure like buildings, vehicles, property and equipment.
- Information: Documents, digital files, brand reputation.
- ICT (Information & Communication Technology): Servers, devices, software, and Internet of Things (IoT).
- Processes: Operations such as supply chain management and accounting.
What are you trying to protect it from?
To ensure asset protection, understanding potential threats is paramount. A wealth of data, including open-source crime statistics, internal incident logs and commercial threat intelligence, can be leveraged to discern these threats. Professionals should maintain a dynamic threat library, updated per the changing threat landscape.
Effective threat analysis involves discerning specific Threat activities (e.g. retail theft) and the respective Threat actors (e.g. a casual thief). Assessing motives, such as financial gain, combined with an understanding of the Intent and Capability of the Threat actor, is vital. SA HB 167:2025 provides practical guidance on conducting Threat analysis to construct a suitable threat library.
How vulnerable is it?
Evaluating vulnerability goes beyond annual checks of security controls. It demands a recognition that the current controls are relevant to the prevailing threat landscape and critical assets. A genuine assessment not only verifies effective controls relevant to the assets underpinning it but also the organisation’s profile. This insight, known as Target Attractiveness, is vital to gauge the Likelihood of threats impacting your organisation.
Calculating the risk
By cross-referencing each threat against each critical asset and then assessing the asset’s vulnerability to each, risks can be calculated based on a widely accepted formula:
Risk = Likelihood x Impact
Likelihood weighs threat level, target attractiveness and the existing level of protective security measures.
Impact considers potential outcomes, or consequences, with the effectiveness of a response capability.
SA HB 167:2025 provides a straightforward process for carrying out this calculation manually, or digital tools can carry it out for you.
The above offers a succinct overview of a standard Security Risk Assessment.
Why a standard security risk assessment matters
As businesses adhere to recognised standards, the corporate security function should be no different. Adopting internationally recognised benchmarks will elevate security professionals’ roles, enhancing their recognition and value in their respective organisations.
“A security risk assessment is the foundation of any security management system.”
Security professionals must be able to answer these three questions to lay a solid foundation for their security strategy to ensure they consistently deliver value to the organisations they are paid to protect.