C2.6 Opportunities

Practitioner standard [6]; register series [9]; enterprise framework [2]

What it requires. Identification is run from the threat side, from the opportunity side and from both, and the technique used is recorded with the side it finds. A positive risk is a first-class register row, with the same statement, node, process and tier as a negative one and an opportunity flag; it is not a note in the margin of a threat. Its responses, in L4, are realize, share and enhance.

Where it comes from. The practitioner standard's catalog of techniques [6] is the only one in the set that asks, tool by tool, whether the tool finds upside, downside or both. The register series [9] gives opportunity a column: three positive responses beside five negative ones. The enterprise framework [2] defines risk to include the favorable case and asks that the portfolio view hold both.

What it reconciles. Every modern framework says opportunities are risks, and almost every register in use contains none, because the techniques that filled it were built to find threats and the fields to score harm. The component requires the technique to be chosen for the side it finds and gives the positive row the same anatomy as the negative one. The fourth principle, that opportunities are native, lives here and in C4.1.