People, Process or Technology?

About this interactive

An enterprise risk management program looks at the risk to the whole company. To make sure every corner gets looked at, the Risk Management Approach lesson offers a few lenses. People, processes and technology is the first. People: the risk comes from the person. Someone may make mistakes, fall for a scam, cut corners, or leave and take knowledge with them. Processes: the risk is in how the work is designed. A step is missing, there is no approval or check, or the work depends on someone remembering to do it. A good employee following a weak process still produces the risk. Technology: the risk is in the systems and tools people use, such as old software, a known flaw, weak settings, or a single point of failure. A quick test: if a different, careful person did the same job, would the risk go away? Then it is people. If the risk stays because the steps themselves are weak, it is process. If the steps and the people are fine but the system is weak, it is technology. The lesson names two other lenses as well: the data states (in transit, at rest, in use) and the CIA triad. Each is a different way to make sure no risk is missed.

What you'll learn

Sort a business risk into the people, processes or technology lens the lesson uses to look for risk across the whole company
Tell a weakness in how a task is designed (process) from a weakness in the person doing it (people) or in the system they use (technology)

Aligned to

CompTIA Security+

5.2 Explain elements of the risk management process.

NIST NICE

K0735 Knowledge of risk management models and frameworks

Key terms

People, Processes, and Technology: The three elements that make up the Cybersecurity Cube's Countermeasures dimension: the human, procedural, and technical elements that must each be evaluated when applying security controls.
Enterprise Risk Management: Enterprise Risk Management is the organization-wide process of identifying, assessing, and prioritizing risks across all business units to minimize the impact of threats on strategic objectives. In cybersecurity, ERM integrates information security risk into the broader corporate risk posture.
Risk Assessment: The process of identifying, analyzing, and evaluating risks to determine their potential impact.
Vulnerability: A weakness in a system, application, or process that can be exploited by a threat actor.

Topics

Risk Management Risk Assessment Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →