ISO 31000 Guide: Principles, Framework and Process

Cyber risk is still managed in a separate silo in many organisations, with its own scales, its own register and its own language, so the board cannot weigh it against the financial, operational and legal risks it already governs. ISO 31000 is the international guideline that gives every type of risk a shared set of principles, a framework for embedding risk management in governance, and a common process. ISO/IEC 27005 for information security, ISO/IEC 23894 for AI and many national frameworks are built on it. This guide explains what ISO 31000:2018 contains, the status of its revision, how to apply it to cyber and identity risk, what evidence shows it is working, and how it maps to NIST CSF 2.0 and NIST SP 800-30. It is written for CISOs, enterprise risk managers, GRC leads and internal auditors.

Key takeaways

ISO 31000 is a guideline, not a certification standard. ISO states that it provides guidelines rather than requirements; you can benchmark against it but not be certified to it.
It has three parts that must work together. Principles say what effective risk management looks like, the framework embeds it in governance, and the process is how individual risks are handled.
A revision is in progress. In October 2026 the ISO catalogue showed ISO 31000:2018 as "to be revised", with ISO/CD 31000 at committee draft stage; the 2018 edition remains current.
Risk is the effect of uncertainty on objectives. That definition includes upside, which is why NIST CSF 2.0 also asks for positive risks (GV.RM-07) to be considered.
Integration is the hard part. The value comes from using one set of criteria and owners for cyber and enterprise risk, so that a stolen API key and a supply disruption can be compared on the same scale.

What it is and who it applies to

ISO 31000:2018, "Risk management: Guidelines", is the second edition, published in February 2018 by ISO/TC 262 Risk management. ISO confirmed it at systematic review in 2023, and the catalogue now marks it "to be revised". The TC 262 work programme lists ISO/CD 31000 "Risk management: Guidelines" at stage 30.60 (close of the committee draft comment period), alongside ISO/WD 31011, a working draft on a management system to address risks and opportunities. No DIS, FDIS or 2026 edition was listed when this guide was written, so treat any claims about the content of the next edition with caution until it reaches enquiry stage.

Who it applies to: any organisation, of any size or sector, and any type of risk. It applies at every level, from board strategy to a single project or system.
Certification: none. ISO describes the 2018 edition as guidelines and states it is not intended for certification. Certification of security risk management happens through ISO/IEC 27001, which aligns with it.
Family: ISO 31073:2022 provides the risk management vocabulary, IEC 31010:2019 describes risk assessment techniques (its second edition expanded the range of techniques and stopped repeating ISO 31000 concepts), and ISO/IEC 27005:2022 specialises the process for information security. See the ISO/IEC 27005 Information Security Risk Guide.
What changed in 2018: according to ISO's release at publication, the 2018 edition reviewed the principles with a focus on creating and protecting value, added emphasis on leadership by top management and integration starting with governance, stressed the iterative nature of risk management, and simplified the language.

Structure and key requirements

The 2018 edition is short (16 pages in the ISO catalogue) and organised in three main clauses. Because it is a guideline, read "requirements" here as the outcomes an assessor benchmarking against it would look for.

Principles

The purpose of risk management, in the standard's framing, is the creation and protection of value. Eight principles describe effective risk management:

Principle	What it means in a cyber programme
Integrated	Cyber risk sits in the enterprise register and decision processes, not a separate spreadsheet
Structured and comprehensive	One consistent method produces comparable results across business units
Customised	Criteria and depth fit the organisation's context and objectives
Inclusive	Business owners, engineering, legal and suppliers are consulted, not only security
Dynamic	Risks are revisited on change: new integrations, new threats, incidents
Best available information	Ratings draw on telemetry, incident data and threat intelligence, with limitations stated
Human and cultural factors	Behaviour, incentives and culture are considered, for example why teams share credentials
Continual improvement	The method itself is reviewed and improved using experience

Framework

The framework is centred on leadership and commitment and surrounded by five activities: integration into governance and operations, design (context, roles, resources, communication), implementation, evaluation of the framework's effectiveness, and improvement. It is the part most often skipped, and it is what turns a register into a management system.

Process

Process element	Activities	Typical cyber output
Communication and consultation	Engage stakeholders throughout	Risk forums, owner briefings
Scope, context and criteria	Define scope, internal and external context, risk criteria	Consequence and likelihood scales, appetite thresholds
Risk assessment: identification	Find, recognise and describe risks	Scenarios with risk sources and owners
Risk assessment: analysis	Understand nature, consequences, likelihood, controls	Rated risks with confidence noted
Risk assessment: evaluation	Compare with criteria to decide action	Prioritised list for treatment
Risk treatment	Select and implement options, assess residual risk	Treatment plans, acceptance decisions
Monitoring and review	Assure quality and effectiveness of process and outcomes	Key risk indicators, periodic reviews
Recording and reporting	Document and report outcomes	Register, board and committee reports

Treatment options in ISO 31000 range from avoiding the risk, taking or increasing it to pursue an opportunity, removing the source, changing likelihood or consequences, sharing it, to retaining it by informed decision. The inclusion of taking risk to pursue opportunity is deliberate and often forgotten in security programmes.

Identity and NHI requirements

ISO 31000 is generic and says nothing specific about identities. Its principles nevertheless expose some of the weakest areas of identity risk management, especially for non-human identities.

Best available information: a risk rating for service accounts or API keys is only as good as the inventory beneath it. If the organisation cannot say how many machine credentials exist, who owns them and when they were last used, the risk record should say so and treat the gap as a risk. See the Service Account Inventory Template.
Dynamic: identity risk changes with every new integration, OAuth consent or AI agent deployment. Change management should trigger reassessment, not an annual cycle alone.
Integrated and inclusive: the business owner of the process a credential serves should own the risk, not the platform team that issued it. See the NHI Ownership Guide.
Human and cultural factors: engineers embed long-lived keys because it is quicker. Treatment that ignores delivery pressure tends to fail; provide a paved road such as workload identity federation and vault integration.
A worked lesson: in the Cloudflare Thanksgiving breach, four credentials exposed in the Okta incident were not rotated because they were mistakenly believed to be unused, and an attacker used them weeks later. In ISO 31000 terms this was an analysis based on an unverified assumption rather than the best available information.

For scoring machine identity risk on a consistent scale, see the NHI Risk Scoring Guide.

Implementation steps

Secure the mandate. Obtain a board or executive statement of commitment and a risk management policy naming accountabilities. This is the leadership and commitment element of the framework.
Agree appetite and criteria. Define appetite at board level, then translate it into consequence and likelihood scales shared by all risk types. See the Cyber Risk Appetite Statement Template.
Map roles to lines. Assign risk owners in the business, oversight in a risk function and independent assurance in internal audit. See the Three Lines Model for Cyber Risk Guide.
Pilot the process in one domain. Run identification, analysis and evaluation for one business unit, including its human and machine identities, and test whether different assessors produce consistent ratings.
Select techniques deliberately. Use IEC 31010 as the catalogue: scenario analysis, bow-tie analysis or attack trees for high-consequence risks, a simple matrix for the long tail, and quantitative methods where decisions need money values. See the Cyber Risk Quantification Guide.
Integrate the register. Move cyber risks into the enterprise risk register with the same fields, owners and reporting cadence. The Risk Register Template gives a starting structure.
Connect treatment to delivery. Every treatment action needs a funded owner and date, tracked in the same system as other work.
Evaluate the framework. At least annually, review whether the framework is achieving its purpose and improve it. When changing scales, run old and new side by side for one cycle so that risk movements are not artefacts of the method.

Choosing between ISO 31000, ISO/IEC 27005 and NIST

Small organisations: one lightweight ISO 31000 process covering all risk types, with a single register and a simple matrix, is usually enough. Add ISO/IEC 27005 detail only if pursuing ISO/IEC 27001 certification.
Organisations seeking ISO/IEC 27001: keep ISO 31000 as the enterprise framework and use ISO/IEC 27005 for the ISMS risk method, sharing criteria so that ISMS risks roll up without translation.
US federal suppliers and regulated sectors referencing NIST: use ISO 31000 for governance and NIST SP 800-30 for assessment mechanics, and report outcomes against CSF 2.0.
Large groups: set criteria and appetite centrally, allow subsidiaries to choose techniques, and require a common minimum record so that results can be aggregated.

Evidence and assessment

With no certification scheme, assurance comes from internal audit, external maturity reviews or regulators who expect a recognised method. The evidence below is what a benchmarking review would ask for.

Area	Evidence	Question a reviewer asks
Leadership	Policy, board minutes, appetite statement	Does the board set appetite and review risk profile?
Integration	Single register, shared criteria	Are cyber risks compared on the same scale as other risks?
Process	Assessment records, treatment plans	Are risks identified, analysed and evaluated consistently?
Ownership	Owner field, acceptance records	Can every owner explain and act on their risks?
Monitoring	Key risk indicators, review logs	Do indicators trigger reassessment?
Improvement	Framework evaluation reports	What changed in the method after the last review?

Metrics that show it is working

Integration rate: share of cyber risks recorded in the enterprise register with common criteria.
Owner engagement: percentage of risks reviewed by their owner within the agreed cycle.
Appetite breaches: number of risks above appetite without an approved treatment or time-bound acceptance (target zero).
Treatment delivery: percentage of treatment actions closed by due date.
Incident foresight: share of material incidents whose scenario was already recorded.

Mapping to other frameworks

ISO 31000 element	NIST CSF 2.0	NIST SP 800-53 Rev. 5	NIST SP 800-30 Rev. 1
Leadership and commitment	GV.RR-01	PM-9	Tier 1 (organisation)
Integration	GV.RM-03	PM-9	Tiers 1 to 3
Scope, context and criteria	GV.OC-03, GV.RM-01, GV.RM-02, GV.RM-06	PM-28, RA-1	Step 1: Prepare
Risk assessment	ID.RA-03, ID.RA-04, ID.RA-05	RA-3	Step 2: Conduct
Risk treatment	ID.RA-06	RA-7	Inputs to risk response
Opportunity (upside risk)	GV.RM-07	None direct	Not addressed
Monitoring, review, improvement	GV.OV-01, ID.IM-01	CA-7	Step 4: Maintain
Recording and reporting	GV.RM-03	PM-9	Step 3: Communicate

NIST SP 800-30 Rev. 1 is narrower: a guide to conducting risk assessments with four steps (prepare, conduct, communicate, maintain), three tiers, and detailed taxonomies of threat sources and events. Many teams use ISO 31000 for the enterprise framework and SP 800-30 for the mechanics of cyber assessment. See the NIST SP 800-30 Risk Assessment Guide, the COSO for Cybersecurity Guide for the ERM view, and the NIST CSF 2.0 Guide.

Common pitfalls

Process without framework: organisations run assessments but never establish leadership, integration and evaluation, so results never reach decisions.
Two sets of scales: cyber uses a 5 by 5 matrix while finance uses money bands, so the board cannot compare risks. Agree one consequence scale with domain-specific anchors.
Claiming certification: marketing or tender responses that say "ISO 31000 certified" are wrong; it is not certifiable. Say "aligned with" and be ready to show evidence.
Threat-only thinking: ignoring the opportunity side leads to security blocking change rather than shaping it; the standard expects both.
Static registers: risks are reviewed annually while identity and cloud estates change daily. Use key risk indicators, such as unowned privileged credentials, to trigger review.
Waiting for the revision: the next edition is still at committee draft stage. Building on the 2018 edition now is low regret, because the core principles, framework and process are widely embedded in other standards.

Practitioner checklist

Confirm the current edition and revision status on the ISO catalogue page before referencing it in policy.
Obtain a board-approved risk management policy and appetite statement.
Use one set of consequence and likelihood criteria across cyber and enterprise risk.
Assign risk owners in the business, including for machine identities and integrations.
Select assessment techniques from IEC 31010 according to the decision being supported.
Record treatment options including retention, with time-bound, authorised acceptance.
Define key risk indicators that trigger reassessment on change.
Evaluate and improve the framework itself at least annually.
Map your process to NIST CSF 2.0 GV.RM and ID.RA outcomes for regulators and auditors.

ISO 31000 Risk Management Guide: Principles, Framework and Process