← VCE Software Development U4O2

A risk management plan for software development

A document that identifies risks to software development, rates them, assigns responses and owners, and sets a schedule for regular review. It links to the threat model.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 128

Understanding A risk management plan for software development in VCE Software Development U4O2

What it does: Risks in the plan are traced to threats in the threat model, so the threats found during threat modelling are managed through the plan. Treating a risk means choosing a response such as mitigate, accept, transfer or avoid, and recording it against the risk in the plan. A risk management plan is a document. It records the risks, how they are rated, who responds and when they are reviewed. It does not block attacks itself. You cannot rate or treat a risk until you have identified it. The usual order is identify, assess, treat, then monitor. Risk is rated using likelihood and impact, often on a risk rating matrix. Lines of code is not a risk rating measure.

Common mistakes: A risk rating combines likelihood and impact by multiplying them. It should be score ← likelihood * impact, so a risk that is both likely and severe scores much higher. High-scoring risks need a response first. The test should be score >= 15, otherwise low-scoring risks get treated and the 20 does not.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add A risk management plan for software development to a class →

This module's key terms are also in a printable crossword (Modules 97–130) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which best describes a risk management plan for software development?
A program that automatically blocks every attack on the softwareA document that identifies risks, rates them, assigns responses and owners, and sets a review schedule
Matches
Risk R5: Stolen API key | Owner: none | Review: none
↓
No owner and no review schedule are assigned, so nobody is responsible and the risk is never monitored
Applying
Meanings
Term
risk management plan
Meaning
A document that identifies risks to software development, rates them, assigns responses and owners, and sets a schedule for regular review. It links to the threat model.
Practice
PLAN: Student Portal risk management
Testing
Gaps
risks ← (threatModel)
Check Answer
Spots
3impact ← 5
4score ← likelihood + impact

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Arctic Hare' badge — Speed Indexer, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which best describes a risk management plan for software development?
A. A document that identifies risks, rates them, assigns responses and owners, and sets a review schedule ✓
B. A program that automatically blocks every attack on the software
A risk management plan is a document. It records the risks, how they are rated, who responds and when they are reviewed. It does not block attacks itself.
2. Which step comes first when building a risk management plan?
A. Treat the risks with controls
B. Identify the risks to the project ✓
You cannot rate or treat a risk until you have identified it. The usual order is identify, assess, treat, then monitor.
3. In the assess step, how is each risk usually rated?
A. By how many lines of code it affects
B. By its likelihood and its impact ✓
Risk is rated using likelihood and impact, often on a risk rating matrix. Lines of code is not a risk rating measure.
4. A plan says 'Risk: stolen developer password. Response: enforce MFA. Owner: Lead Developer.' What does the owner column show?
A. Who is responsible for carrying out the response ✓
B. Who caused the risk to happen
The owner is the person accountable for the response. Assigning owners means every risk has someone who acts on it.
5. Which is an example of the 'treat' step in a risk management plan?
A. Choosing a control such as patching, encryption or MFA to reduce the risk ✓
B. Writing the risk's name in the risk list
Treating a risk means choosing a response that reduces it, such as a control. Listing the risk is part of the identify step.

Match the Pairs

Risk R3: SQL injection | Likelihood: High | Impact: Severe → The assess step: the risk is identified and rated by its likelihood and its impact
Owner: Lead Developer | Review: monthly → Responsibilities and monitoring: a named person owns the risk and the plan is reviewed on a schedule
The plan links back to the threat model by recording which threat each risk came from → Risk R3 | Source: Threat model T2 (Tampering)
The treat step assigns a response to a rated risk and records it in the plan → Risk R3 | Response: Mitigate - use parameterised queries
Risk R5: Stolen API key | Owner: none | Review: none → No owner and no review schedule are assigned, so nobody is responsible and the risk is never monitored
Risk R2: Weak passwords | Likelihood: High | Response: (blank) → The risk is identified and partly rated, but there is no impact rating and no response, so it has not been properly assessed or treated

Key Term

risk management plan
A document that identifies risks to software development, rates them, assigns responses and owners, and sets a schedule for regular review. It links to the threat model.

Fill in the Blanks

1. risks ← identify(threatModel)
Hint: Type the function name for the first step, which finds risks using the threat model.
2. rating ← likelihood * impact
Hint: Type the arithmetic operator that combines likelihood and impact into a risk rating.
3. risk.owner ← "Lead developer"
Hint: Type the property name that records who is responsible for managing the risk.
4. IF rating ≥ 6 THEN treat(risk)
Hint: Type the function name that applies a response to a high-rated risk.
5. IF today = dueDate THEN review(plan)
Hint: Type the function name that re-checks the whole plan on its scheduled date.

Spot the Error

Question 1
A risk ← 'SQL injection'
B likelihood ← 4
C impact ← 5
D score ← likelihood + impact
Line D — A risk rating combines likelihood and impact by multiplying them. It should be score ← likelihood * impact, so a risk that is both likely and severe scores much higher.
Question 2
A risk ← 'Leaked API key'
B score ← 20
C IF score <= 15 THEN
D response ← 'Treat now'
E END IF
Line C — High-scoring risks need a response first. The test should be score >= 15, otherwise low-scoring risks get treated and the 20 does not.
Question 3
A identify: wait for an attack
B assess: likelihood x impact
C treat: set response and owner
D monitor: review on schedule
Line A — A risk management plan identifies risks before they happen, using the threat model. Waiting for an attack means the risk is only found after the damage is done.
Question 4
A risk: Unpatched server
B rating: High
C response: Ignore it
D owner: Network admin
Line C — A High rated risk needs a planned treatment. The response should be an action such as 'Patch within 7 days', not ignoring the risk.
Question 5
A risk ← 'Weak passwords'
B treatment ← 'Enforce MFA'
C owner ← nobody
D PRINT risk, treatment, owner
Line C — Every risk needs a named person responsible for its treatment. The owner should be a role such as 'Security lead', not nobody.

Student with a class code? Join your class →