Risk assessment: the cornerstone of a secure and resilient organization

By Ernie Hayden MIPM, GICSP(Gold), PSP, CISSP (Retired)

Risk assessments are the cornerstone of a secure and resilient organization, but undertaking them is more than checking boxes or following a template — it requires both critical thinking and an exceptional attention to detail.

In my book, Critical Infrastructure Risk Assessment, I emphasize that while technical skills are essential, these less tangible capabilities separate competent assessments from truly effective ones.

Critical thinking allows an assessor to look beyond surface-level threats and vulnerabilities—questioning assumptions, anticipating new risks, and connecting complex dots within an environment. This disciplined approach ensures that hidden gaps and emerging weaknesses are identified, not just those that are already well-known or documented.

In a word, critical thinking requires you to always ask the question, “What can go wrong? How do I prevent it from causing damage or disablement?”

Attention to detail is equally vital. Every risk assessment involves poring over physical layouts, operational processes, staff behaviors, security controls, and regulatory requirements. Overlooking a single detail can mean missing a potential risk with significant real-world consequences. It’s the careful observation in every audit, site walk-down, and review that gives the assessment its strength and reliability.

Ultimately, while technical skills can be learned, it’s the fusion of sharp thinking and relentless attention to detail that results in a risk assessment clients can trust—and one that truly makes a difference.

Ernie Hayden MIPM, GICSP(Gold), PSP, CISSP (Retired) is the author of the ASIS INTERNATIONAL BOOK OF THE YEAR: Critical Infrastructure Risk Assessment: The Definitive Threat Identification and Threat Reduction Handbook.

Click here to learn more about Critical Infrastructure
Risk Assessment

Get your free chapter — “The Power of the Observation”

• • An overview of the concept of an “observation.”
  • The primary elements included in the observation, as well as its format.
  • Fundamental considerations when performing and documenting the observation, including the power of one’s influence on the actions being observed, the need for critical thinking, and considerations on how the observation supports the risk assessment.

Click HERE to receive your free chapter!

 

Book Available from Amazon – click here

ePub or PDF eBook – click here

#criticalinfrastructure #riskassessment #erniehayden #threat identification