Security teams that cannot express their work as risk end up arguing about tools and budgets, while the decisions that matter, which risks to accept, which to fix first and which to insure, are made without them. Cyber risk management is the discipline of identifying what could go wrong, estimating how likely and how harmful it is, choosing a response, and checking that the response works. This pillar covers the whole cycle at overview depth: the core concepts, the threats that drive most cyber loss, controls by maturity, ownership, and the standards behind it (ISO 31000, ISO/IEC 27005, NIST SP 800-30 and SP 800-37, NIST CSF 2.0, COSO and FAIR). It is for CISOs, risk managers, GRC analysts and engineers who own risk register entries, and it links every deep guide in the NHI Mgmt Group Risk Management category.
Key takeaways
- Risk is a decision tool, not a report. The point of assessing risk is to choose between treating, transferring, avoiding or accepting it, with a named owner who has the authority to decide.
- Appetite comes first. Without a board-approved appetite and tolerances (NIST CSF 2.0 GV.RM-02), every rating is an opinion and every exception is a negotiation.
- One method, written down. CSF 2.0 GV.RM-06 asks for a standardised method for calculating, documenting, categorising and prioritising risk; written scales let two analysts reach the same rating from the same facts.
- Cyber risk belongs in enterprise risk. GV.RM-03 expects cyber risk in enterprise risk management processes, so a stolen API key and a supply disruption are compared on one scale.
- Assessments age fast. Monitoring risk factors and updating results (SP 800-30 step 4) is where most programmes fail; tie reassessment to change, incidents and new threat intelligence.
What the field covers
Cyber risk management sits between security operations and enterprise governance. It answers four questions: what are we trying to protect and why, what could harm it, how much does that matter, and what are we doing about it. The field breaks into connected activities.
| Activity | Question it answers | Main outputs |
|---|---|---|
| Risk governance | Who decides, and within what limits? | Risk policy, appetite statement, roles, committee terms |
| Context and criteria | What matters to the organisation? | Asset and process criticality, likelihood and impact scales |
| Risk assessment | What could happen, how likely, how bad? | Rated scenarios with owners and confidence |
| Risk treatment | What will we do about it? | Treatment plans, accepted risks, exceptions |
| Risk transfer | What can be shifted to insurers or contracts? | Insurance programme, contractual indemnities |
| Third-party risk | What risk do suppliers bring? | Tiered supplier register, assessments |
| Monitoring and reporting | Is risk moving inside appetite? | Key risk indicators, register reviews, board reports |
| Assurance | Can we trust the above? | Second-line challenge, internal audit opinions |
Core concepts
- Risk: ISO 31000 defines it as the effect of uncertainty on objectives, which includes upside; CSF 2.0 GV.RM-07 likewise asks for strategic opportunities (positive risks) to be considered. FAIR, in the Open Group Risk Taxonomy, defines risk as the probable frequency and probable magnitude of future loss.
- Threat, vulnerability, likelihood and impact: SP 800-30 models risk from a threat source and threat event exploiting a vulnerability under predisposing conditions, producing an impact with a given likelihood. See the Threat vs Vulnerability vs Risk Guide.
- Inherent and residual risk: inherent risk is the level before controls (CSF 2.0 ID.RA-05 uses threats, vulnerabilities, likelihoods and impacts to understand it); residual risk is what remains after treatment and is what an owner accepts.
- Appetite and tolerance: appetite is the amount and type of risk the organisation is willing to pursue; tolerances are the measurable limits that trigger escalation. See the Cyber Risk Appetite Statement Template.
- Qualitative, semi-quantitative and quantitative analysis: labels and heat maps, numeric bands behind labels, or probability distributions in money. Ordinal scales cannot be multiplied meaningfully, which is the main argument for quantification where data allows. See the Cyber Risk Quantification Guide.
- Treatment options: mitigate (reduce likelihood or impact), transfer or share (insurance, contracts), avoid (stop the activity) and accept (retain by informed decision). ISO 31000 also lists taking or increasing risk to pursue an opportunity.
- Risk tiers: NIST SP 800-39 and SP 800-30 work at three tiers: organisation, mission or business process, and information system. Decisions at system level must stay consistent with organisation-level appetite.
- Key risk indicators versus performance indicators: a KPI says whether a control activity is being done (patches deployed this month); a KRI says whether exposure is moving towards a tolerance (internet-facing systems with known exploited vulnerabilities older than 14 days). Boards need KRIs tied to appetite; operations teams need both.
- Aggregation: individual risks can each sit inside tolerance while their combination does not, for example many business units depending on the same identity provider or cloud region. Review clusters of risks that share a cause, an asset or a supplier, not only single entries. See the Third-Party Concentration Risk Guide.
- Uncertainty: every rating rests on incomplete knowledge of threats, undiscovered vulnerabilities and unrecognised dependencies. Recording confidence next to a rating tells the decision maker how much weight to put on it, and where better data would change the answer.
Main threats
Risk registers should be built from realistic scenarios rather than generic categories. These scenario families drive most cyber loss and appear in most registers. Write each one as a specific threat, vector, asset and effect for your own environment, and track the leading indicators as KRIs.
| Scenario family | Typical loss | Leading indicators to track |
|---|---|---|
| Credential and identity compromise (stolen passwords, tokens, API keys, service accounts) | Data theft, ransomware, fraud | Accounts without MFA, infostealer exposures, unrotated secrets, standing privilege |
| Ransomware and extortion | Outage, recovery cost, data leak, regulatory reporting | Backup restore test results, exposed remote access, patch latency |
| Third-party and supply chain compromise | Inherited breach, outage at a shared provider | Critical suppliers without assessment, concentration on one provider |
| Exploitation of internet-facing vulnerabilities | Initial access at scale | Known exploited vulnerabilities open beyond SLA |
| Insider misuse and error | Data exposure, sabotage, misconfiguration | Privileged users without monitoring, misconfiguration findings |
| Cloud and SaaS misconfiguration | Public data exposure | Posture findings, unmanaged tenants and OAuth grants |
| Business email compromise and payment fraud | Direct financial loss | Payment change verification failures, mailbox rule alerts |
Two incidents show why scenarios must be specific. In the Change Healthcare breach, a single stolen credential on a remote-access portal without MFA led to nine days of undetected movement, ransomware, nationwide disruption and projected 2024 costs of $2.87 billion: a register entry for "ransomware" would not have pointed at the exempt gateway. In the SolarWinds compromise, trust in a signed vendor update delivered the backdoor to customers, the archetype of inherited third-party risk. For insider scenarios, see the Insider Threat Statistics Guide.
Key controls by maturity
| Capability | Foundational | Established | Advanced |
|---|---|---|---|
| Governance | Risk policy and a named accountable executive | Board-approved appetite and tolerances; risk committee | Appetite metrics reported against KRIs each quarter |
| Method | Written 5x5 likelihood and impact scales | Documented method aligned to ISO/IEC 27005 or SP 800-30, with uncertainty recorded | Quantified top scenarios (FAIR, Monte Carlo) with loss exceedance curves |
| Register | Single register with owner, rating and treatment | Linked to controls, assets and incidents; reviewed on change | Integrated with enterprise risk and continuous control monitoring |
| Treatment and exceptions | Exceptions recorded with expiry | Approval authority tiered by residual rating; compensating controls required | Exception volume and age tracked as KRIs |
| Third parties | Critical supplier list | Tiered assessments and contract clauses | Concentration analysis and exit plans |
| Transfer | Basic cyber insurance | Limits sized from scenario analysis | Retention and limits set from quantified tail loss |
| Assurance | Annual self-review | Independent second-line challenge | Internal audit opinion on risk management effectiveness |
How to implement
- Frame: agree scope, objectives and criteria; draft the appetite statement and get board approval (GV.RM-01, GV.RM-02; SP 800-53 PM-9 and PM-28).
- Define the method: write scales with examples for each level, decide when to quantify, and set reassessment triggers (GV.RM-06).
- Pilot: run the method on one business unit or ten top scenarios, compare ratings between two analysts, and refine scales where they disagree.
- Assess: identify vulnerabilities and threats (ID.RA-01, ID.RA-04; SP 800-53 RA-3), rate inherent and residual risk, and record confidence.
- Treat: choose, prioritise, plan and track responses (ID.RA-06; RA-7), with plans of action and milestones for open gaps (CA-5).
- Accept formally: residual risk above tolerance goes to an owner with matching authority, time-bound, with compensating controls. See the Security Exceptions and Risk Acceptance Guide.
- Monitor and roll back: track KRIs and reassess on change; if a new method produces ratings the business cannot use, run old and new side by side for a cycle before switching.
Decision guidance
- Qualitative or quantitative: qualitative for broad coverage and quick triage; quantify the few scenarios where money decisions (insurance limits, large investments) depend on the answer. See the Quantitative vs Qualitative Cyber Risk Guide.
- ISO 31000 and 27005, or NIST: ISO suits organisations running an ISO/IEC 27001 ISMS (clause 6.1.2 risk assessment); the NIST RMF suits US federal systems needing authorisation; CSF 2.0 Govern works with either.
- Small organisation: one register, one page of scales, a quarterly review and a short appetite statement are enough; skip tooling.
- Large or regulated organisation: integrate with enterprise risk under COSO ERM, apply the three lines, and expect regulators to test board oversight. See the COSO for Cybersecurity Guide.
Detection and measurement
- Risks outside appetite: number and trend of risks above tolerance, and days each has been there.
- Treatment delivery: percentage of treatment actions closed by their due date.
- Exception health: count of active exceptions, share past expiry, and median age.
- Register freshness: share of high risks reassessed within the review cycle or after a relevant change.
- Prediction quality: incidents that matched a register scenario versus surprises; a high surprise rate means the scenarios are too generic.
- Identity exposure KRI: privileged and non-human accounts without MFA or rotation, a direct leading indicator for the top scenario family.
Worked example: one scenario through the cycle
The table follows a single register entry from identification to monitoring. Ratings are illustrative and depend on the organisation's own scales and evidence.
| Stage | Entry |
|---|---|
| Scenario statement | Financially motivated criminals use a leaked CI/CD pipeline token to exfiltrate the customer database, leading to regulatory notification and customer claims |
| Context and owner | Asset: customer data platform. Owner: head of digital products, who holds the platform budget |
| Inherent rating | Likelihood high (tokens found in public repositories in the last year, long-lived tokens with broad scope); impact very high (regulated personal data, notification duties) |
| Existing controls | Secret scanning on the main repository only; tokens rotated manually once a year |
| Residual rating | High, above the tolerance set in the appetite statement for confidentiality of customer data |
| Treatment decision | Mitigate: short-lived federated credentials for pipelines, organisation-wide secret scanning, token scope reduction. Transfer: confirm cyber insurance covers notification and claims costs |
| Interim acceptance | Residual risk accepted by the owner for 90 days with a compensating control (alerting on token use from unknown networks), recorded as an exception |
| KRIs | Number of long-lived pipeline tokens; secrets detected per month; median time to revoke an exposed secret |
| Reassessment trigger | Treatment delivered, a secret exposure incident, or a new pipeline platform |
Three things make this entry useful: it names a specific vector an engineer can act on, the owner can fund the fix, and the acceptance expires. Compare it with a generic "data breach" line, which no one can estimate, fund or close.
Where identity fits
Identity is the most common thread through cyber loss scenarios, and it is also one of the most measurable. Human accounts without phishing-resistant MFA, privileged accounts with standing access, and non-human identities such as service accounts, API keys, OAuth grants and pipeline tokens are each a countable exposure that can become a KRI. Many registers under-represent non-human identities because they are not owned by a person and do not appear in HR-driven access reviews. Treat an inventory of non-human identities, their owners and their credential age as a risk input in its own right. See the Third-Party Access Guide for the supplier side of the same problem.
Reporting risk to the board
- Lead with appetite: show which risks sit outside tolerance and what decision is needed, not a full heat map.
- Show movement: trend each top risk over the last four quarters and explain changes by treatment delivered or threat change.
- Use money where it is credible: a quantified range for the top two or three scenarios supports insurance and investment decisions; avoid false precision on the rest.
- Link to obligations: where a law such as NIS2 or DORA requires management bodies to approve and oversee risk measures, record the approval and the training in the minutes. See the Risk Appetite and Tolerance for Cyber Guide.
Roles and ownership
| Role | Responsibility |
|---|---|
| Board and risk committee | Approve appetite, oversee top risks, hold management to account (CSF 2.0 GV.RR-01, GV.OV) |
| Executive risk owners | Own risks in their business area and accept residual risk within delegated authority |
| CISO | Run the cyber risk method, advise owners, own security treatment plans |
| Chief risk officer or ERM function | Integrate cyber into enterprise risk; second-line challenge |
| Control owners | Operate treatments and report KRIs |
| Internal audit | Independent assurance over the risk process and key controls |
| Authorising official (NIST RMF) | Formally accept residual risk for a system; the decision cannot be delegated |
Roles must be established, communicated and enforced (GV.RR-02). The usual failure is a risk owner with no budget authority, so treatment stalls. See the Three Lines Model for Cyber Risk Guide.
Standards and frameworks
| Standard | Role | Status note |
|---|---|---|
| ISO 31000:2018 | Principles, framework and process for any risk | Guidelines, not certifiable; ISO lists it as to be revised |
| ISO/IEC 27005 | Information security risk management, supporting ISO/IEC 27001 | See the deep guide |
| NIST SP 800-30 Rev. 1 | Method for conducting risk assessments across three tiers | Final, September 2012 |
| NIST SP 800-37 Rev. 2 | Risk Management Framework: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor | Final, December 2018 |
| NIST CSF 2.0 | GV.RM risk strategy, GV.SC supply chain risk, ID.RA risk assessment | Current version |
| COSO ERM | Enterprise risk integration and internal control | See the deep guide |
| FAIR (Open Group O-RT and O-RA) | Quantitative risk taxonomy and analysis | See the deep guide |
Supply chain risk maps to CSF 2.0 GV.SC-07 and SP 800-53 PM-30 and SR-3. ENISA's Interoperable EU Risk Management Framework and Toolbox help organisations compare and combine methods across member states.
Common failure patterns
- Heat map arithmetic: multiplying ordinal scores and ranking the products as if they were money.
- Generic scenarios: "ransomware" as one register line, which hides the specific gateway or token that matters, as Change Healthcare showed.
- Permanent exceptions: acceptances with no expiry or owner, which quietly become the control baseline.
- Cyber register separate from enterprise risk: the board never sees cyber risk next to the risks it already manages.
- Supplier risk assessed once: questionnaires at onboarding and nothing after, the gap SolarWinds exploited at scale.
Practitioner checklist
- Get a board-approved appetite statement with measurable tolerances.
- Write likelihood and impact scales with concrete examples, and test them with two analysts.
- Build the register from specific scenarios with named owners who hold budget authority.
- Record inherent and residual ratings and the confidence behind each.
- Time-bound every risk acceptance and require compensating controls.
- Quantify the few scenarios that drive insurance and major investment decisions.
- Track 3 to 6 KRIs, including identity exposure and exception age, and report them quarterly.
- Reassess on significant change, incident or new threat intelligence, not only annually.
Where to go next
New to Risk Management? These are the foundational guides to read first.
Start here
- ISO 31000 Risk Management Guide: principles, framework and process.
- ISO/IEC 27005 Information Security Risk Guide: assessing and treating information security risk.
- NIST SP 800-30 Risk Assessment Guide: threats, likelihood, impact and ratings.
- NIST Risk Management Framework (SP 800-37) Guide: the seven steps from Prepare to Monitor.
- COSO for Cybersecurity Guide: COSO internal control and ERM applied to cyber.
- Cyber Risk Quantification Guide: FAIR and Monte Carlo.
- Three Lines Model for Cyber Risk Guide: roles, independence and assurance.
- Cyber Risk Appetite Statement Template: board-approved tolerances.
- Risk Register Template: fields and workflow for a cyber register.
- Security Exceptions and Risk Acceptance Guide: waivers and formal acceptance.
- Cyber Insurance Guide: coverage, requirements and claims.
Browse all Risk Management guides
Standards and references
- ISO: ISO 31000:2018 Risk management, Guidelines
- NIST: SP 800-30 Rev. 1, Guide for Conducting Risk Assessments
- NIST: SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5
- ENISA: Risk management
Related NHI Mgmt Group resources: Cyber Risk Quantification Guide · Risk Register Template · Third-Party Risk Management Guide · Regulations and Frameworks Guide