Risk Breakdown Structure (RBS)

A layered structure that organizes possible sources of project risk into categories and subcategories.

Key Points

  • Shows risk sources in a tree from broad categories to detailed subcategories.
  • Used during risk identification and planning to improve coverage and reduce blind spots.
  • Enables aggregation of risk exposure and assignment of ownership by category.
  • Can be customized and aligned with the WBS/OBS to support reporting and lessons learned.

Example

On a construction project, the team builds an RBS with top-level categories: Technical, External, Organizational, and Project Management. Under Technical they list items like design errors, material quality, and equipment failure; under External they include weather and regulatory changes. They brainstorm risks and tag each one to the RBS branch, ensuring complete coverage and allowing roll-up of exposure by category for reporting.

PMP Example Question

During qualitative risk analysis, the project manager wants to group identified risks and roll up exposure by source to focus response planning. Which artifact should the team use?

  1. Work Breakdown Structure
  2. Risk Breakdown Structure
  3. Risk Register
  4. Stakeholder Breakdown Structure

Correct Answer: B — Risk Breakdown Structure

Explanation: The RBS organizes risks by source, enabling grouping and roll-up. The WBS decomposes scope, the risk register lists risks, and the stakeholder breakdown structure categorizes stakeholders.

ICS/OT Incident Response Drills and Exercises

An incident response plan is only a theory until the people who must use it have run it under pressure. This course helps OT engineers, operations leaders, IT responders, and security teams turn a plan on paper into a tested capability.

Define safe states and manual fallback before an incident forces the decision. Build escalation paths, tabletop exercises, and scenarios that expose the gaps a document review cannot find.

Then turn the results into evidence: an after-action report, owned improvements, recovery checks, and a drill cadence that keeps the program alive after the exercise ends.

24 lessons, 2.4 hours. US$47 one-time through HKSM Courses. 30-day money-back guarantee when 50% or less consumed.

Explore the Course


ICS/OT Incident Response Drills and Exercises course preview

Build an ICS/OT cybersecurity foundation that fits the real environment

Standard IT controls can disrupt the industrial systems they are meant to protect. Learn how to assess OT risk, design zones and conduits, apply IEC 62443 security levels, use MITRE ATT&CK for ICS, and establish passive asset visibility without risking production. Eight reconstructed incidents connect attacker techniques to the controls that failed, giving you the vocabulary and judgment to make credible security decisions from day one.

Explore the Course