Targeted Risk Analysis

Overview

Targeted risk analysis is used when a standard or organization permits certain control frequencies, methods, or alternatives to be determined through risk. In PCI DSS contexts, particular requirements call for documented analysis using specified elements.

It is narrower than an enterprise risk assessment and should not be used to justify broad noncompliance. Quality depends on asset scope, threats, likelihood, consequences, control performance, data, assumptions, and the authority approving the decision.

Organizations should use the current applicable criteria, document methodology and evidence, specify resulting frequency or control, assign ownership, and set review triggers. Changes, incidents, failed controls, or new threats should cause reassessment before the original decision expires.

Targeted Risk Analysis is a measurable uncertainty or exposure that evaluates a specific requirement, activity, threat, or control decision using documented factors and a defined scope. A targeted risk analysis supports a specific control decision only when scope, required factors, evidence, approval, and review triggers are explicit.

For Targeted Risk Analysis, the assessment should evaluate evaluation of a specific requirement, activity, threat, or control decision using documented factors and a defined scope. The assessment record should separate observed evidence supporting evaluation of a specific requirement, activity, threat, or control decision using documented factors and a defined scope from assumptions, state the time horizon and existing controls, and identify who owns any remaining exposure. Monitoring should test whether the conditions described in evaluation of a specific requirement, activity, threat, or control decision using documented factors and a defined scope have changed enough to require a new rating, treatment, or approval.

Decision-makers should use findings about evaluation of a specific requirement, activity, threat, or control decision using documented factors and a defined scope to select treatment, assign remediation, set review thresholds, and document why any residual exposure is accepted.