Risk-Based Compliance Prioritization

Most compliance programs are checkbox-driven: implement every control on the list, allocate equal effort to each, and hope the auditor is satisfied. This leads to over-investment in low-risk areas and under-investment in high-risk ones. Risk-based prioritization flips this: identify where actual risk lies, allocate effort proportionally, and build a compliance program that genuinely protects the business.

---

Risk Assessment Framework

Risk Scoring

Risk = Likelihood × Impact

Likelihood (1-5):
  1: Rare (once per decade)
  2: Unlikely (once per year)
  3: Possible (once per quarter)
  4: Likely (once per month)
  5: Almost certain (weekly)

Impact (1-5):
  1: Negligible (< $10K, no data, no regulatory)
  2: Minor ($10K-$100K, internal data, warning)
  3: Moderate ($100K-$1M, limited PII, investigation)
  4: Major ($1M-$10M, significant breach, fine)
  5: Critical (> $10M, massive breach, criminal liability)

Risk Register

Risk	Likelihood	Impact	Score	Priority
SQL injection exposing PII	4	5	20	Critical
Employee laptop theft	3	3	9	Medium
Unpatched external service	4	4	16	High
Internal wiki accessed by contractor	2	2	4	Low
Ransomware on backups	3	5	15	High
Misconfigured S3 bucket	4	4	16	High

---

Control Mapping

Map Controls to Risks

risk: "SQL injection exposing PII"
score: 20
controls:
  preventive:
    - name: "Parameterized queries"
      effectiveness: high
      implementation: complete
    - name: "WAF with OWASP rule set"
      effectiveness: medium
      implementation: complete
    - name: "Input validation library"
      effectiveness: medium
      implementation: partial (70%)
  
  detective:
    - name: "SQL injection detection (RASP)"
      effectiveness: high
      implementation: not_started
    - name: "Database activity monitoring"
      effectiveness: medium
      implementation: complete
  
  corrective:
    - name: "Incident response plan"
      effectiveness: medium
      implementation: complete
    - name: "Data breach notification process"
      effectiveness: high
      implementation: partial (80%)

residual_risk: 8 (reduced from 20)
treatment: mitigate (implement remaining controls)

---

Risk-Adjusted Roadmap

Quarter 1 (Critical + High risks):
  ☐ Complete RASP deployment (reduces SQL injection risk)
  ☐ Patch management automation (reduces unpatched service risk)
  ☐ S3 bucket policy automation (reduces misconfiguration risk)
  ☐ Immutable backup solution (reduces ransomware risk)

Quarter 2 (High + Medium risks):
  ☐ Endpoint encryption enforcement (reduces laptop theft risk)
  ☐ Complete input validation rollout (reduces injection risk)
  ☐ Contractor access review automation
  ☐ Breach notification process drill

Quarter 3 (Medium + continuous improvement):
  ☐ Red team exercise
  ☐ Compliance dashboard for executives
  ☐ Vendor risk assessment automation
  ☐ Employee security awareness program

---

Continuous Compliance

# Automated compliance checks, not annual audits

scheduled_checks:
  daily:
    - Public S3 buckets: 0 expected
    - Unencrypted databases: 0 expected
    - Expired TLS certificates: 0 expected
    
  weekly:
    - Users without MFA: 0 expected
    - Overprivileged IAM roles: list and review
    - Security group changes: verify all approved
    
  monthly:
    - Vulnerability scan of external-facing services
    - Access review for critical systems
    - Compliance dashboard update for leadership
    
  quarterly:
    - Penetration test
    - Incident response tabletop exercise
    - Full risk register review and re-score

---

Anti-Patterns

Anti-Pattern	Consequence	Fix
Checkbox compliance only	Controls implemented but actual risks not addressed	Risk-based prioritization
Annual assessment only	11 months of drift	Continuous compliance monitoring
Equal effort on all controls	Over-invest in low risk, under-invest in high risk	Prioritize by risk score
No residual risk tracking	Cannot prove risk reduction	Track before/after risk scores
Skip executive reporting	No budget for compliance	Risk-based dashboard for leadership

Compliance is not about having controls. It is about having the right controls for your actual risks, implemented effectively, and verified continuously.