Content library
Risk management
Assesment of residual risks (DORA)
Risk management and leadership
Risk management

Assesment of residual risks (DORA)

Start free trial

Task description

Assesment of residual risks (DORA)

After risk treatment, the organization assesses and identifies any remaining residual ICT risks for each risk assessed. Residual ICT risks that exceed the organization’s defined ICT risk tolerance level must either be further treated or formally accepted by the risk owner.

The acceptance of such residual ICT risks requires documented justification and formal approval by senior management or the designated risk governance body. The organization maintains an inventory of all accepted residual ICT risks, including their respective justifications.

All accepted residual ICT risks are subject to review at least annually. This review includes:

  • identification of any changes to the residual risk
  • assessment of any new or available mitigation measures
  • reassessment of the validity of the justification for acceptance.

Requirements connected to the task

No items found.

Other tasks from the same security theme

Task name
Priority
Policy
Other requirements
Creating and maintaining risk management framework -report
Critical
High
Normal
Low
Risk management
6
requirements

Examples of other requirements this task affects

Article 5: Governance and organisation
DORA
Article 6: ICT risk management framework
DORA
Article 29: Information security policy and measures
DORA simplified RMF
See all related requirements and other information from tasks own page.
Go to >
Creating and maintaining risk management framework -report
Risk management policy -report publishing, informing and maintenance
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

GV.PO-01: Policy for managing cybersecurity risks
NIST 2.0
GV.PO-02: Policy for managing cybersecurity risks
NIST 2.0
See all related requirements and other information from tasks own page.
Go to >
Risk management policy -report publishing, informing and maintenance
Identification and documentation of cyber security risks
Critical
High
Normal
Low
Risk management
70
requirements

Examples of other requirements this task affects

Članak 30.1.a: Politike analize rizika i sigurnosti informacijskih sustava
NIS2 Croatia
2.5: Riskienhallinta
TiHL tietoturvavaatimukset
7 §: Riskienhallinta
Kyberturvallisuuslaki
1.4.1: Management of Information Security Risks
TISAX
13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
TiHL
See all related requirements and other information from tasks own page.
Go to >
Identification and documentation of cyber security risks
Risk management procedure -report publishing and maintenance
Critical
High
Normal
Low
Risk management
80
requirements

Examples of other requirements this task affects

Članak 30.1.a: Politike analize rizika i sigurnosti informacijskih sustava
NIS2 Croatia
2.5: Riskienhallinta
TiHL tietoturvavaatimukset
8 §: Kyberturvallisuutta koskeva riskienhallinnan toimintamalli
Kyberturvallisuuslaki
1.4.1: Management of Information Security Risks
TISAX
30 § 1°: Gestion des risques et maîtrise des incidents
NIS2 Belgium
See all related requirements and other information from tasks own page.
Go to >
Risk management procedure -report publishing and maintenance
Risk assessment in technical documentation
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

Article 13.4: Risk assessment in technical documentation
CRA
See all related requirements and other information from tasks own page.
Go to >
Risk assessment in technical documentation
Vulnerability management process
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

Article 13.3: Documenting risk assessment
CRA
See all related requirements and other information from tasks own page.
Go to >
Vulnerability management process
Updating the risk assessment
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

Article 13.3: Documenting risk assessment
CRA
See all related requirements and other information from tasks own page.
Go to >
Updating the risk assessment
Risk assessment of products
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

Article 13.2: Risk assessment
CRA
See all related requirements and other information from tasks own page.
Go to >
Risk assessment of products
Risk rating system for logical control systems
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Risk rating system for logical control systems
Defining the frequency and criteria for risk and vulnerability reassessment
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Defining the frequency and criteria for risk and vulnerability reassessment
Risk assessment background information for participants
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

12.2: Risk assessment measures
CER
See all related requirements and other information from tasks own page.
Go to >
Risk assessment background information for participants
Taking risk management into account in strategic decision making process
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Taking risk management into account in strategic decision making process
Monitoring of risks
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Monitoring of risks
Assesment of residual risks (DORA)
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Assesment of residual risks (DORA)
Establishing risk tolerance level
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Establishing risk tolerance level
Security management process for ePHI
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Security management process for ePHI
Remediation plan for identified deficiencies
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

12.5: Planul de măsuri pentru remedierea deficiențelor
NIS2 Romania
See all related requirements and other information from tasks own page.
Go to >
Remediation plan for identified deficiencies
Risk assessment for new acquisitions
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

§ 9-4.1: Myndighet til å fatte vedtak ved anskaffelser til skjermingsverdig informasjonssystem, objekt og infrastruktur
Sikkerhetsloven
See all related requirements and other information from tasks own page.
Go to >
Risk assessment for new acquisitions
Personnel clearance procedure
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

§ 8-2: Sikkerhetsklarering
Sikkerhetsloven
See all related requirements and other information from tasks own page.
Go to >
Personnel clearance procedure
Managing security authorization
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

§ 8-10: Nedsettelse, suspensjon og tilbakekallelse av autorisasjon
Sikkerhetsloven
See all related requirements and other information from tasks own page.
Go to >
Managing security authorization
Personnel authorization procedure
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

§ 8-9: Autorisasjon
Sikkerhetsloven
§ 8-1.1: Krav om sikkerhetsklarering, adgangsklarering og autorisasjon
Sikkerhetsloven
§ 8-1.2: Krav om konfidensiell og kritisk sikkerhetsklarering
Sikkerhetsloven
See all related requirements and other information from tasks own page.
Go to >
Personnel authorization procedure
Conduct and document a protective security analysis
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

§ 2.1: Skyldigheter för den som bedriver säkerhetskänslig verksamhet
SSL
See all related requirements and other information from tasks own page.
Go to >
Conduct and document a protective security analysis
Procedure for security assessments in transfers of sensitive activities
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

§ 4.14: Säkerhetsbedömning för sekretessbelagd information
SSL
§ 4.9: Lämplighetsprövningen
SSL
See all related requirements and other information from tasks own page.
Go to >
Procedure for security assessments in transfers of sensitive activities
Create and maintain a system architecture and risk assessment document
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

13.4: Sikring af udsendelse af offentlige advarsler
NIS2 Denmark
See all related requirements and other information from tasks own page.
Go to >
Create and maintain a system architecture and risk assessment document
Conducting threat modeling
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

16.14: Conduct Threat Modeling
CIS 18
See all related requirements and other information from tasks own page.
Go to >
Conducting threat modeling
Monitoring service providers
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

15.6: Monitor Service Providers
CIS 18
See all related requirements and other information from tasks own page.
Go to >
Monitoring service providers
Assessing service providers
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

15.5: Assess Service Providers
CIS 18
See all related requirements and other information from tasks own page.
Go to >
Assessing service providers
Evaluation of risk management strategy, results and performance
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

GV.OV-03: Organizational cybersecurity risk management performance
NIST 2.0
GV.OV-01: Cybersecurity risk management strategy review
NIST 2.0
GV.OV-02: Coverage of organization requirements in cybersecurity risk management strategy
NIST 2.0
See all related requirements and other information from tasks own page.
Go to >
Evaluation of risk management strategy, results and performance
Strategic opportunities and positive risks
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

GV.RM-07: Strategic opportunities in organizational cybersecurity risk discussions
NIST 2.0
See all related requirements and other information from tasks own page.
Go to >
Strategic opportunities and positive risks
Creating and maintaining risk assessment framework
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

1.1.3: Identify the organisation’s processes for ICT risk management
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Creating and maintaining risk assessment framework
Identification and assessment of risks based on the classification of data sets
Critical
High
Normal
Low
Risk management
0
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Identification and assessment of risks based on the classification of data sets
Enabling asset-based risk management in the ISMS
Critical
High
Normal
Low
Risk management
8
requirements

Examples of other requirements this task affects

Article 8: Identification
DORA
2.5: Riskienhallinta
TiHL tietoturvavaatimukset
5.2.2: Seperation of testing and development environments
TISAX
1.1.3: Identify the organisation’s processes for ICT risk management
NSM ICT-SP
Article 31: ICT risk management
DORA simplified RMF
See all related requirements and other information from tasks own page.
Go to >
Enabling asset-based risk management in the ISMS
Assigning responsibility of ICT-risk management to appropriate function
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

Article 6: ICT risk management framework
DORA
See all related requirements and other information from tasks own page.
Go to >
Assigning responsibility of ICT-risk management to appropriate function
Consideration of security-classified risks to information in risk management
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

T-03: TIETOTURVALLISUUSRISKIEN HALLINTA
Katakri 2020
See all related requirements and other information from tasks own page.
Go to >
Consideration of security-classified risks to information in risk management
Regular internal monitoring of the implementation of the information security management system
Critical
High
Normal
Low
Risk management
41
requirements

Examples of other requirements this task affects

Članak 30.1.f: Politike i postupke za procjenu djelotvornosti mjera upravljanja kibernetičkim sigurnosnim rizicima
NIS2 Croatia
10 §: Johdon vastuu
Kyberturvallisuuslaki
9.1 §: Toimien vaikuttavuuden arviointi
Kyberturvallisuuslaki
1.2.1: Scope of Information Security management
TISAX
1.5.1: Assessment of policies and requirements
TISAX
See all related requirements and other information from tasks own page.
Go to >
Regular internal monitoring of the implementation of the information security management system
Documentation of linked risks for identified security incidents
Critical
High
Normal
Low
Risk management
28
requirements

Examples of other requirements this task affects

Članak 30.1.a: Politike analize rizika i sigurnosti informacijskih sustava
NIS2 Croatia
7 §: Riskienhallinta
Kyberturvallisuuslaki
30 § 3.1°: L'analyse des risques et à la sécurité des systèmes d'information
NIS2 Belgium
4.4.1: Identify experiences and lessons learnt from incidents
NSM ICT-SP
4.3.1: Identify extent and impact on business processes
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Documentation of linked risks for identified security incidents
Luettelo salassa pidettävän tiedon käsittelyä edellyttävistä työtehtävistä
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

T12: Tiedonsaantitarve ja käsittelyoikeudet
Katakri
HAL-10: Henkilöstön luotettavuuden arviointi
Julkri
T-13: TIEDONSAANTITARVE JA KÄSITTELYOIKEUDET
Katakri 2020
I-06: VÄHIMPIEN OIKEUKSIEN PERIAATE – PÄÄSYOIKEUKSIEN HALLINNOINTI
Katakri 2020
See all related requirements and other information from tasks own page.
Go to >
Luettelo salassa pidettävän tiedon käsittelyä edellyttävistä työtehtävistä
Yleiset muutostenhallintamenettelyt (ST IV-III)
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

I20: Muutoshallintamenettelyt
Katakri
See all related requirements and other information from tasks own page.
Go to >
Yleiset muutostenhallintamenettelyt (ST IV-III)
Yleiset muutostenhallintamenettelyt (ST II)
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

I20: Muutoshallintamenettelyt
Katakri
See all related requirements and other information from tasks own page.
Go to >
Yleiset muutostenhallintamenettelyt (ST II)
Evaluation process and documentation of significant security-related changes
Critical
High
Normal
Low
Risk management
51
requirements

Examples of other requirements this task affects

Članak 30.1.a: Politike analize rizika i sigurnosti informacijskih sustava
NIS2 Croatia
7 §: Riskienhallinta
Kyberturvallisuuslaki
5.2.1: Change management
TISAX
30 § 3.1°: L'analyse des risques et à la sécurité des systèmes d'information
NIS2 Belgium
2.10.1: Include security in the organisation’s change management process
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Evaluation process and documentation of significant security-related changes
Treatment process and documentation of identified non-conformities
Critical
High
Normal
Low
Risk management
27
requirements

Examples of other requirements this task affects

1.5.1: Assessment of policies and requirements
TISAX
30 § 6°: Non-conformités et mesures correctives
NIS2 Belgium
I-11: MONITASOINEN SUOJAAMINEN – POIKKEAMIEN HAVAINNOINTIKYKY JA TOIPUMINEN
Katakri 2020
45.(3): Neatbilstības un koriģējošās darbības
NIS2 Latvia
Art 24.4: Non conformità e azioni correttive
NIS2 Italy
See all related requirements and other information from tasks own page.
Go to >
Treatment process and documentation of identified non-conformities
Taking the results of risk management into account in audit procedures
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

Article 6: ICT risk management framework
DORA
1.4.1: Management of Information Security Risks
TISAX
See all related requirements and other information from tasks own page.
Go to >
Taking the results of risk management into account in audit procedures
Consideration of risk management results in continuity planning
Critical
High
Normal
Low
Risk management
7
requirements

Examples of other requirements this task affects

29: Jatkuvuuteen liittyvien riskien arviointi
Digiturvan kokonaiskuvapalvelu
30: Riskeihin perustuvat jatkuvuussuunnitelmat
Digiturvan kokonaiskuvapalvelu
1.4.1: Management of Information Security Risks
TISAX
28.(1): Kiberriska pārvaldības un nepārtrauktības plāni
NIS2 Latvia
§ 10: Krav om sikkerhet for tilbydere av digitale tjenester
NIS2 NO
See all related requirements and other information from tasks own page.
Go to >
Consideration of risk management results in continuity planning
Practicing disaster plans
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

§ 13.3: Beredskapsplanlegging og øvelser
NIS2 NO
See all related requirements and other information from tasks own page.
Go to >
Practicing disaster plans
Process for including information security aspects in project management
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

6.1.5: Information security in project management
ISO 27001
5.8: Information security in project management
ISO 27001
1.2.3: Information Security requirements in projects
TISAX
See all related requirements and other information from tasks own page.
Go to >
Process for including information security aspects in project management
Assessment of the impact and likelihood of the risks and the scales used
Critical
High
Normal
Low
Risk management
12
requirements

Examples of other requirements this task affects

ID.RA-4: Impacts on business
NIST
Article 6: ICT risk management framework
DORA
2.5: Riskienhallinta
TiHL tietoturvavaatimukset
1.4.1: Management of Information Security Risks
TISAX
ID.RA-04: Impacts and likelihoods of threats
NIST 2.0
See all related requirements and other information from tasks own page.
Go to >
Assessment of the impact and likelihood of the risks and the scales used
Approval of the risk management procedure description
Critical
High
Normal
Low
Risk management
8
requirements

Examples of other requirements this task affects

ID.RM-1: Risk management processes
NIST
14.5.2): Aukščiausiosios vadovybės atsakomybė
NIS2 Lithuania
Article 6: ICT risk management framework
DORA
1.4.1: Management of Information Security Risks
TISAX
ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders.
CyberFundamentals
See all related requirements and other information from tasks own page.
Go to >
Approval of the risk management procedure description
Risk level accepted by the organization
Critical
High
Normal
Low
Risk management
38
requirements

Examples of other requirements this task affects

Članak 30.1.a: Politike analize rizika i sigurnosti informacijskih sustava
NIS2 Croatia
8 §: Kyberturvallisuutta koskeva riskienhallinnan toimintamalli
Kyberturvallisuuslaki
30 § 3.1°: L'analyse des risques et à la sécurité des systèmes d'information
NIS2 Belgium
1.1.4: Identify the organisation’s tolerances for ICT risk
NSM ICT-SP
1.1.2: Identify the organisation’s structures and processes for security management
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Risk level accepted by the organization
Evaluation of the information security measures defined in the risk management phase
Critical
High
Normal
Low
Risk management
5
requirements

Examples of other requirements this task affects

HAL-06: Riskienhallinta
Julkri
RISK-4: Respond to Cyber Risk
C2M2
CC5.1: Control activities for mitigation of risks
SOC 2
1.4.1: Management of Information Security Risks
TISAX
Article 31: ICT risk management
DORA simplified RMF
See all related requirements and other information from tasks own page.
Go to >
Evaluation of the information security measures defined in the risk management phase
Legal risks related to the service
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

HAL-06.1: Riskienhallinta - lainsäädäntöjohdannaiset riskit
Julkri
See all related requirements and other information from tasks own page.
Go to >
Legal risks related to the service
Fyysisen turvallisuuden riskien arviointi
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

FYY-01: Fyysisen turvallisuuden riskien arviointi
Julkri
F-02: Fyysisten turvatoimien riskien arviointi
Katakri 2020
8 §: Kyberturvallisuutta koskeva riskienhallinnan toimintamalli
Kyberturvallisuuslaki
See all related requirements and other information from tasks own page.
Go to >
Fyysisen turvallisuuden riskien arviointi
Muutoshallintamenettelyt tietojenkäsittely-ympäristöissä (TL IV)
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

TEK-17.3: Muutoshallintamenettelyt
Julkri
I-16: TURVALLISUUSLUOKITELLUN TIEDON KÄSITTELYYN LIITTYVÄN TIETOJENKÄSITTELY-YMPÄRISTÖN SUOJAUS KOKO ELINKAAREN AJAN – MUUTOSHALLINTAMENETTELYT
Katakri 2020
See all related requirements and other information from tasks own page.
Go to >
Muutoshallintamenettelyt tietojenkäsittely-ympäristöissä (TL IV)
Immediate reporting of critical risks to top management
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

18: Kriittisten riskien raportointi
Digiturvan kokonaiskuvapalvelu
1.1.3: Identify the organisation’s processes for ICT risk management
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Immediate reporting of critical risks to top management
Monitoring the status of risk management
Critical
High
Normal
Low
Risk management
9
requirements

Examples of other requirements this task affects

14.5.2): Aukščiausiosios vadovybės atsakomybė
NIS2 Lithuania
19: Riskienhallinan tilanteen seuraaminen
Digiturvan kokonaiskuvapalvelu
CC5.1: Control activities for mitigation of risks
SOC 2
Article 6: ICT risk management framework
DORA
2.5: Riskienhallinta
TiHL tietoturvavaatimukset
See all related requirements and other information from tasks own page.
Go to >
Monitoring the status of risk management
Consideration of critical functions in risk management
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

74: Kriittisten palveluiden riskien arviointi ja hallinta
Digiturvan kokonaiskuvapalvelu
ID.BE-4: Dependencies and critical functions for delivery of critical services are established.
CyberFundamentals
31: Besondere Anforderungen an die Risikomanagementmaßnahmen von Betreibern kritischer Anlagen
NIS2 Germany
12.1: Risk assessments
CER
See all related requirements and other information from tasks own page.
Go to >
Consideration of critical functions in risk management
Identification of risks endangering the continuity of operations and their handling plans
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

CC9.1: Treatment plans for business disruption risks
SOC 2
28.(1): Kiberriska pārvaldības un nepārtrauktības plāni
NIS2 Latvia
See all related requirements and other information from tasks own page.
Go to >
Identification of risks endangering the continuity of operations and their handling plans
Consideration of information security goals in risk assessment
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

CC5.1: Control activities for mitigation of risks
SOC 2
30 § 2°: Évaluation des risques et mesures de gestion
NIS2 Belgium
§ 7: Risikovurdering
NIS2 NO
See all related requirements and other information from tasks own page.
Go to >
Consideration of information security goals in risk assessment
Segregation of tasks in information security risk management
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

CC5.1: Control activities for mitigation of risks
SOC 2
See all related requirements and other information from tasks own page.
Go to >
Segregation of tasks in information security risk management
Regular external auditing of security practices
Critical
High
Normal
Low
Risk management
27
requirements

Examples of other requirements this task affects

Članak 30.1.f: Politike i postupke za procjenu djelotvornosti mjera upravljanja kibernetičkim sigurnosnim rizicima
NIS2 Croatia
9.1 §: Toimien vaikuttavuuden arviointi
Kyberturvallisuuslaki
1.5.2: External review of ISMS
TISAX
30 § 3.6°: L'efficacité des mesures de gestion des risques
NIS2 Belgium
14.5.7): Kibernetinio saugumo reikalavimų veiksmingumui
NIS2 Lithuania
See all related requirements and other information from tasks own page.
Go to >
Regular external auditing of security practices
Detection of non-compliance with the change management procedure
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

CC3.4: Identification and assesment of changes
SOC 2
ID.IM-01: Improvements from evaluations
NIST 2.0
See all related requirements and other information from tasks own page.
Go to >
Detection of non-compliance with the change management procedure
Rules for deviating from the change management procedure
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

CC3.4: Identification and assesment of changes
SOC 2
5.2.1: Change management
TISAX
See all related requirements and other information from tasks own page.
Go to >
Rules for deviating from the change management procedure
Regular communication of the general risk situation to the organization's management
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

17: Riskitilanteen raportointi johdolle
Digiturvan kokonaiskuvapalvelu
CC3.2: Identification of risks related to objectives
SOC 2
1.1.4: Identify the organisation’s tolerances for ICT risk
NSM ICT-SP
GV.RM-05: Communication lines for cybersecurity risks across the organization
NIST 2.0
See all related requirements and other information from tasks own page.
Go to >
Regular communication of the general risk situation to the organization's management
Assessment of residual risks
Critical
High
Normal
Low
Risk management
26
requirements

Examples of other requirements this task affects

Članak 30.1.a: Politike analize rizika i sigurnosti informacijskih sustava
NIS2 Croatia
2.5: Riskienhallinta
TiHL tietoturvavaatimukset
7 §: Riskienhallinta
Kyberturvallisuuslaki
30 § 3.1°: L'analyse des risques et à la sécurité des systèmes d'information
NIS2 Belgium
ID.GV-4: Governance and risk management processes address cybersecurity risks.
CyberFundamentals
See all related requirements and other information from tasks own page.
Go to >
Assessment of residual risks
Continuous improvement of the risk management process
Critical
High
Normal
Low
Risk management
28
requirements

Examples of other requirements this task affects

Članak 30.1.a: Politike analize rizika i sigurnosti informacijskih sustava
NIS2 Croatia
8 §: Kyberturvallisuutta koskeva riskienhallinnan toimintamalli
Kyberturvallisuuslaki
1.4.1: Management of Information Security Risks
TISAX
30 § 3.1°: L'analyse des risques et à la sécurité des systèmes d'information
NIS2 Belgium
ID.GV-4: Governance and risk management processes address cybersecurity risks.
CyberFundamentals
See all related requirements and other information from tasks own page.
Go to >
Continuous improvement of the risk management process
Consideration of partner risks in information security risk management
Critical
High
Normal
Low
Risk management
5
requirements

Examples of other requirements this task affects

CC9.2: Partner risk management
SOC 2
1.3.3: Use of approved external IT services
TISAX
30 § 2°: Évaluation des risques et mesures de gestion
NIS2 Belgium
19.2.i (ġestjoni tar-riskju): Ġestjoni tar-riskju minn ġewwa
NIS2 Malta
12.1: Mesures de sécurité et gestion des risques
NIS2 Luxembourg
See all related requirements and other information from tasks own page.
Go to >
Consideration of partner risks in information security risk management

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way‍
Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
Do it once - we automatically apply it to all current and future frameworks.
Start free trial
Get to know Cyberday
Start your free trial
Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
Clear framework compliance plans
Activate relevant frameworks and turn them into actionable policies tailored to your needs.
Credible reports to proof your compliance
Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
AI-powered improvement suggestions
Focus on the most impactful improvements in your compliance with help from Cyberday AI.
Effortless compliance improvement
Widest framework library in EU
Extensive support

Start your compliance journey

Use in MS Teams or use your browser with Slack integration.
Risk free trial. No credit card required. Stop at any time.

Start free 14-day trial
Book a meeting
How it works?
SummarySecurity tasks and assuranceDocumentation workflowsEmployee guidelinesReporting templates
Use cases
By frameworkAll frameworksISO 27001NIS2 directiveNIST CSFCSA CCMISO 27701GDPRISO 27017ISO 27018
By methodCyber risk managementEmployee awarenessCompliance reportingControl managementAsset managementPrivacy managementVendor assessments
Resources
AcademyWebinarsBlogHelp articlesVideo coursesContent libraryGuidesNewsletterLeave a reviewPartner programTeamTerms of usePrivacy policy
Contact us
+358 10 231 6010
team@cyberday.ai
App works in:
Known in Finland as Digiturvamalli
© Cyberday Inc. Kalevantie 2 33100 Tampere, Finland
Cyberday.ai - Improve and certify your cyber security
No items found.