Riskikohteiden

Riskikohteiden, or risk targets, are the assets, systems, people, processes, and information that could suffer harm if exposed to threats and vulnerabilities. They form the focal point of risk assessment and risk management because the severity of risk is determined by the value of the target, the likelihood of threat occurrence, and the potential impact.

In risk management, risk targets are identified through asset inventories and business impact analyses. They are classified by criticality, sensitivity, and exposure. Threats and vulnerabilities affecting each target are analyzed to estimate risk levels using qualitative scales or quantitative models. The assessment helps prioritize where to focus controls and resources.

Examples of risk targets include physical infrastructure such as facilities and equipment; information assets such as data, software, and networks; human resources and key personnel; critical processes; and supply chains. In cybersecurity, data integrity and availability are typical risk targets, while in operations they may be production lines or service delivery processes.

Management of risk targets involves selecting and implementing controls to reduce either the likelihood of a threat exploiting a vulnerability or the impact if it occurs. Measures may include physical security, access controls, backup and disaster recovery, cybersecurity technologies, vendor risk management, and incident response planning. Risk treatment also involves decisions about transferring, accepting, or avoiding certain risks.

The concept is integrated into widely used frameworks such as ISO 31000, ISO 27001, and NIST guidelines, which emphasize identifying and protecting the most valuable and vulnerable targets to maintain organizational resilience.