A risk management plan for software development

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which best describes a risk management plan for software development?

A A document that identifies risks, rates them, assigns responses and owners, and sets a review schedule

B A program that automatically blocks every attack on the software

2. Which step comes first when building a risk management plan?

A Treat the risks with controls

B Identify the risks to the project

3. In the assess step, how is each risk usually rated?

A By how many lines of code it affects

B By its likelihood and its impact

4. A plan says 'Risk: stolen developer password. Response: enforce MFA. Owner: Lead Developer.' What does the owner column show?

A Who is responsible for carrying out the response

B Who caused the risk to happen

5. Which is an example of the 'treat' step in a risk management plan?

A Choosing a control such as patching, encryption or MFA to reduce the risk

B Writing the risk's name in the risk list

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Risk R3: SQL injection \| Likelihood: High \| Impact: Severe		AThe risk is identified and partly rated, but there is no impact rating and no response, so it has not been properly assessed or treated
2Owner: Lead Developer \| Review: monthly		BNo owner and no review schedule are assigned, so nobody is responsible and the risk is never monitored
3The plan links back to the threat model by recording which threat each risk came from		CResponsibilities and monitoring: a named person owns the risk and the plan is reviewed on a schedule
4The treat step assigns a response to a rated risk and records it in the plan		DRisk R3 \| Response: Mitigate - use parameterised queries
5Risk R5: Stolen API key \| Owner: none \| Review: none		EThe assess step: the risk is identified and rated by its likelihood and its impact
6Risk R2: Weak passwords \| Likelihood: High \| Response: (blank)		FRisk R3 \| Source: Threat model T2 (Tampering)

Definitions

risk management plan

Fill in the Blanks

Complete each line of code by filling in the missing parts.

risks ← ________(threatModel)

rating ← likelihood _ impact

risk._____ ← "Lead developer"

IF rating ≥ 6 THEN _____(risk)

IF today = dueDate THEN ______(plan)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A risk ← 'SQL injection'

B likelihood ← 4

C impact ← 5

D score ← likelihood + impact

Question 2

A risk ← 'Leaked API key'

B score ← 20

C IF score <= 15 THEN

D response ← 'Treat now'

E END IF

Question 3

A identify: wait for an attack

B assess: likelihood x impact

C treat: set response and owner

D monitor: review on schedule

Question 4

A risk: Unpatched server

B rating: High

C response: Ignore it

D owner: Network admin

Question 5

A risk ← 'Weak passwords'

B treatment ← 'Enforce MFA'

C owner ← nobody

D PRINT risk, treatment, owner

Answer Key

A risk management plan for software development

Section A: Quick Questions

A — A document that identifies risks, rates them, assigns responses and owners, and sets a review schedule

B — Identify the risks to the project

B — By its likelihood and its impact

A — Who is responsible for carrying out the response

A — Choosing a control such as patching, encryption or MFA to reduce the risk

Section B: Match the Pairs

Risk R3: SQL injection | Likelihood: High | Impact: Severe → The assess step: the risk is identified and rated by its likelihood and its impact

Owner: Lead Developer | Review: monthly → Responsibilities and monitoring: a named person owns the risk and the plan is reviewed on a schedule

The plan links back to the threat model by recording which threat each risk came from → Risk R3 | Source: Threat model T2 (Tampering)

The treat step assigns a response to a rated risk and records it in the plan → Risk R3 | Response: Mitigate - use parameterised queries

Risk R5: Stolen API key | Owner: none | Review: none → No owner and no review schedule are assigned, so nobody is responsible and the risk is never monitored

Risk R2: Weak passwords | Likelihood: High | Response: (blank) → The risk is identified and partly rated, but there is no impact rating and no response, so it has not been properly assessed or treated

Section C: Definitions

risk management plan — A document that identifies risks to software development, rates them, assigns responses and owners, and sets a schedule for regular review. It links to the threat model.

Section D: Fill in the Blanks

risks ← identify(threatModel)

rating ← likelihood * impact

risk.owner ← "Lead developer"

IF rating ≥ 6 THEN
    treat(risk)

IF today = dueDate THEN review(plan)

Section E: Spot the Error

D — A risk rating combines likelihood and impact by multiplying them. It should be score ← likelihood * impact, so a risk that is both likely and severe scores much higher.

C — High-scoring risks need a response first. The test should be score >= 15, otherwise low-scoring risks get treated and the 20 does not.

A — A risk management plan identifies risks before they happen, using the threat model. Waiting for an attack means the risk is only found after the damage is done.

C — A High rated risk needs a planned treatment. The response should be an action such as 'Patch within 7 days', not ignoring the risk.

C — Every risk needs a named person responsible for its treatment. The owner should be a role such as 'Security lead', not nobody.