Content library
Risk management
Health-related security risk management and oversight
Risk management and leadership
Risk management

Health-related security risk management and oversight

Start free trial

Task description

Health-related security risk management and oversight

When technical risk-reducing measures for healthcare-related issues cannot be implemented immediately, the organization should apply temporary administrative controls to limit exposure until permanent solutions are in place.

Risk assessments should be supported by appropriate expertise and involve healthcare representatives where relevant, and shall explicitly consider the potential consequences for patients and the provision of healthcare.

To ensure proper handling and oversight:

  • Risk assessors must have a clear escalation path to management or the board
  • Results of the assessment and planned follow-up actions shall be communicated to leadership at the appropriate level

These steps ensure that risks are addressed effectively and remain visible to decision-makers.

Requirements connected to the task

No items found.

Other tasks from the same security theme

Task name
Priority
Policy
Other requirements
Electronic information system security classification (Hungary)
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

10. §: A biztonsági osztályba sorolás
NIS2 Hungary
6. § (3).5: Rendszerbiztonsági besorolás
NIS2 Hungary
6. § (6): A vezetői felelősség köre
NIS2 Hungary
See all related requirements and other information from tasks own page.
Go to >
Electronic information system security classification (Hungary)
Creating and maintaining risk management framework -report
Critical
High
Normal
Low
Risk management
8
requirements

Examples of other requirements this task affects

Article 5: Governance and organisation
DORA
Article 6: ICT risk management framework
DORA
Article 29: Information security policy and measures
DORA simplified RMF
§ 12: Politik for risikostyring
Energisektor beredskabsbekendtgørelse
See all related requirements and other information from tasks own page.
Go to >
Creating and maintaining risk management framework -report
Health-related security risk management and oversight
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Health-related security risk management and oversight
Risk assessment review after major incidents
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Risk assessment review after major incidents
Planning and evaluating risk and opportunity responses
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Planning and evaluating risk and opportunity responses
Security strategy and treatment selection criteria
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Security strategy and treatment selection criteria
Conduct and document a protective security analysis (Sweden)
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

§ 2.1: Skyldigheter för den som bedriver säkerhetskänslig verksamhet
SSL
See all related requirements and other information from tasks own page.
Go to >
Conduct and document a protective security analysis (Sweden)
Risk management policy -report publishing, informing and maintenance
Critical
High
Normal
Low
Risk management
7
requirements

Examples of other requirements this task affects

GV.PO-01: Policy for managing cybersecurity risks
NIST 2.0
GV.PO-02: Policy for managing cybersecurity risks
NIST 2.0
§ 12: Politik for risikostyring
Energisektor beredskabsbekendtgørelse
2.1.1: Risk management framework
NIS2 Guide
See all related requirements and other information from tasks own page.
Go to >
Risk management policy -report publishing, informing and maintenance
Identification and documentation of cyber security risks
Critical
High
Normal
Low
Risk management
108
requirements

Examples of other requirements this task affects

Članak 30.1.a: Politike analize rizika i sigurnosti informacijskih sustava
NIS2 Croatia
2.5: Riskienhallinta
TiHL tietoturvavaatimukset
7 §: Riskienhallinta
Kyberturvallisuuslaki
1.4.1: Management of Information Security Risks
TISAX
13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
TiHL
See all related requirements and other information from tasks own page.
Go to >
Identification and documentation of cyber security risks
Risk management procedure -report publishing and maintenance
Critical
High
Normal
Low
Risk management
135
requirements

Examples of other requirements this task affects

Članak 30.1.a: Politike analize rizika i sigurnosti informacijskih sustava
NIS2 Croatia
2.5: Riskienhallinta
TiHL tietoturvavaatimukset
8 §: Kyberturvallisuutta koskeva riskienhallinnan toimintamalli
Kyberturvallisuuslaki
1.4.1: Management of Information Security Risks
TISAX
30 § 1°: Gestion des risques et maîtrise des incidents
NIS2 Belgium
See all related requirements and other information from tasks own page.
Go to >
Risk management procedure -report publishing and maintenance
Risk assessment prior to making changes to health and personal data
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Risk assessment prior to making changes to health and personal data
Criminal background check for key personnel
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

8f: Weryfikacja przeszłości kryminalnej personelu
NIS2 Poland
See all related requirements and other information from tasks own page.
Go to >
Criminal background check for key personnel
Assessment of climate change
Critical
High
Normal
Low
Risk management
10
requirements

Examples of other requirements this task affects

4.2: Interested parties
ISO 27001
4.1: Organization and its context
ISO 27001
4.1: Organization and its context
ISO 9001
4.2: Needs and expectations of interested parties
ISO 9001
See all related requirements and other information from tasks own page.
Go to >
Assessment of climate change
Initial assessment of security measures
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

6. § (3).9: A biztonsági intézkedések kezdeti értékelése
NIS2 Hungary
See all related requirements and other information from tasks own page.
Go to >
Initial assessment of security measures
Risk assessment for cloud services and foreign data processing
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

9. §: Adatosztályozási szabályok
NIS2 Hungary
See all related requirements and other information from tasks own page.
Go to >
Risk assessment for cloud services and foreign data processing
Security management process for ePHI
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Security management process for ePHI
Security performance evaluation through other measures
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

A2.c: Assurance of security effectiveness
CAF 4.0
See all related requirements and other information from tasks own page.
Go to >
Security performance evaluation through other measures
Understanding threat actor capabilities
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

A2.b: Understanding threat actors
CAF 4.0
See all related requirements and other information from tasks own page.
Go to >
Understanding threat actor capabilities
Managing actively exploited vulnerabilities
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

Člen 22.8: Uporaba ranljivih IKT rešitev
NIS2 Slovenia
6.5: Security testing
NIS2 Guide
See all related requirements and other information from tasks own page.
Go to >
Managing actively exploited vulnerabilities
Integration of external risk and vulnerability information
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

§ 18: Risiko- og sårbarhedsvurdering
Energisektor beredskabsbekendtgørelse
See all related requirements and other information from tasks own page.
Go to >
Integration of external risk and vulnerability information
Submission of project risk assessments to the Danish Energy Agency (Denmark)
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

§ 28: Godkendelse af risikovurderinger
Energisektor beredskabsbekendtgørelse
See all related requirements and other information from tasks own page.
Go to >
Submission of project risk assessments to the Danish Energy Agency (Denmark)
Annual cybersecurity assessment and reporting for critical infrastructure
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

Article 38: Cybersecurity risk and detection reporting obligations
CSL (China)
See all related requirements and other information from tasks own page.
Go to >
Annual cybersecurity assessment and reporting for critical infrastructure
Identification and documentation of assets (Czech Republic)
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Identification and documentation of assets (Czech Republic)
Training in risk assessment methodology
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Training in risk assessment methodology
Risk assessment in technical documentation
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

Article 13.4: Risk assessment in technical documentation
CRA
See all related requirements and other information from tasks own page.
Go to >
Risk assessment in technical documentation
Vulnerability management process
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

Article 13.3: Documenting risk assessment
CRA
See all related requirements and other information from tasks own page.
Go to >
Vulnerability management process
Updating the risk assessment
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

Article 13.3: Documenting risk assessment
CRA
See all related requirements and other information from tasks own page.
Go to >
Updating the risk assessment
Risk assessment of products
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

Article 13.2: Risk assessment
CRA
See all related requirements and other information from tasks own page.
Go to >
Risk assessment of products
Risk rating system for logical control systems
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Risk rating system for logical control systems
Defining the frequency and criteria for risk and vulnerability reassessment
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Defining the frequency and criteria for risk and vulnerability reassessment
Risk assessment background information for participants
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

12.2: Risk assessment measures
CER
§ 13: Riskbedömning
NIS2 Åland
See all related requirements and other information from tasks own page.
Go to >
Risk assessment background information for participants
Taking risk management into account in strategic decision making process
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Taking risk management into account in strategic decision making process
Monitoring of risks
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Monitoring of risks
Assesment of residual risks (DORA)
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Assesment of residual risks (DORA)
Establishing risk tolerance level
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

12: Rizikos valdymo planas
NIS2 Guide Lithuania
See all related requirements and other information from tasks own page.
Go to >
Establishing risk tolerance level
Security management process for ePHI
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

Article 26: Processing health data
PDPL
See all related requirements and other information from tasks own page.
Go to >
Security management process for ePHI
Remediation plan for identified deficiencies
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

12.5: Planul de măsuri pentru remedierea deficiențelor
NIS2 Romania
See all related requirements and other information from tasks own page.
Go to >
Remediation plan for identified deficiencies
Risk assessment for new acquisitions
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

§ 9-4.1: Myndighet til å fatte vedtak ved anskaffelser til skjermingsverdig informasjonssystem, objekt og infrastruktur
Sikkerhetsloven
§ 27: Risikovurdering
Energisektor beredskabsbekendtgørelse
6.1: Security in acquisition of ICT services or ICT products
NIS2 Guide
See all related requirements and other information from tasks own page.
Go to >
Risk assessment for new acquisitions
Personnel clearance procedure
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

§ 8-2: Sikkerhetsklarering
Sikkerhetsloven
See all related requirements and other information from tasks own page.
Go to >
Personnel clearance procedure
Managing security authorization
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

§ 8-10: Nedsettelse, suspensjon og tilbakekallelse av autorisasjon
Sikkerhetsloven
See all related requirements and other information from tasks own page.
Go to >
Managing security authorization
Personnel authorization procedure
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

§ 8-1.2: Krav om konfidensiell og kritisk sikkerhetsklarering
Sikkerhetsloven
§ 8-9: Autorisasjon
Sikkerhetsloven
§ 8-1.1: Krav om sikkerhetsklarering, adgangsklarering og autorisasjon
Sikkerhetsloven
See all related requirements and other information from tasks own page.
Go to >
Personnel authorization procedure
Procedure for security assessments in transfers of sensitive activities
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

§ 4.14: Säkerhetsbedömning för sekretessbelagd information
SSL
§ 4.9: Lämplighetsprövningen
SSL
See all related requirements and other information from tasks own page.
Go to >
Procedure for security assessments in transfers of sensitive activities
Create and maintain a system architecture and risk assessment document
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

13.4: Sikring af udsendelse af offentlige advarsler
NIS2 Denmark
§ 2.4: Dokumentation av it-miljön
MSBFS 2020:7
See all related requirements and other information from tasks own page.
Go to >
Create and maintain a system architecture and risk assessment document
Conducting threat modeling
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

16.14: Conduct Threat Modeling
CIS 18
A2.b: Understanding threat actors
CAF 4.0
See all related requirements and other information from tasks own page.
Go to >
Conducting threat modeling
Monitoring service providers
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

15.6: Monitor Service Providers
CIS 18
See all related requirements and other information from tasks own page.
Go to >
Monitoring service providers
Assessing service providers
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

15.5: Assess Service Providers
CIS 18
See all related requirements and other information from tasks own page.
Go to >
Assessing service providers
Evaluation of risk management strategy, results and performance
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

GV.OV-01: Cybersecurity risk management strategy review
NIST 2.0
GV.OV-02: Coverage of organization requirements in cybersecurity risk management strategy
NIST 2.0
GV.OV-03: Organizational cybersecurity risk management performance
NIST 2.0
See all related requirements and other information from tasks own page.
Go to >
Evaluation of risk management strategy, results and performance
Strategic opportunities and positive risks
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

GV.RM-07: Strategic opportunities in organizational cybersecurity risk discussions
NIST 2.0
See all related requirements and other information from tasks own page.
Go to >
Strategic opportunities and positive risks
Creating and maintaining risk assessment framework
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

1.1.3: Identify the organisation’s processes for ICT risk management
NSM ICT-SP
§ 27: Risikovurdering
Energisektor beredskabsbekendtgørelse
See all related requirements and other information from tasks own page.
Go to >
Creating and maintaining risk assessment framework
Identification and assessment of risks based on the classification of data sets
Critical
High
Normal
Low
Risk management
0
requirements

Examples of other requirements this task affects

No items found.
See all related requirements and other information from tasks own page.
Go to >
Identification and assessment of risks based on the classification of data sets
Enabling asset-based risk management in the ISMS
Critical
High
Normal
Low
Risk management
10
requirements

Examples of other requirements this task affects

Article 8: Identification
DORA
2.5: Riskienhallinta
TiHL tietoturvavaatimukset
5.2.2: Seperation of testing and development environments
TISAX
1.1.3: Identify the organisation’s processes for ICT risk management
NSM ICT-SP
Article 31: ICT risk management
DORA simplified RMF
See all related requirements and other information from tasks own page.
Go to >
Enabling asset-based risk management in the ISMS
Assigning responsibility of ICT-risk management to appropriate function
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

Article 6: ICT risk management framework
DORA
See all related requirements and other information from tasks own page.
Go to >
Assigning responsibility of ICT-risk management to appropriate function
Consideration of security-classified risks to information in risk management
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

T-03: MANAGEMENT OF INFORMATION SECURITY RISKS
Katakri 2020
See all related requirements and other information from tasks own page.
Go to >
Consideration of security-classified risks to information in risk management
Regular internal monitoring of the implementation of the information security management system
Critical
High
Normal
Low
Risk management
65
requirements

Examples of other requirements this task affects

Članak 30.1.f: Politike i postupke za procjenu djelotvornosti mjera upravljanja kibernetičkim sigurnosnim rizicima
NIS2 Croatia
10 §: Johdon vastuu
Kyberturvallisuuslaki
9.1 §: Toimien vaikuttavuuden arviointi
Kyberturvallisuuslaki
1.2.1: Scope of Information Security management
TISAX
1.5.1: Assessment of policies and requirements
TISAX
See all related requirements and other information from tasks own page.
Go to >
Regular internal monitoring of the implementation of the information security management system
Documentation of linked risks for identified security incidents
Critical
High
Normal
Low
Risk management
41
requirements

Examples of other requirements this task affects

5. Principles relating to processing of personal data
GDPR
24. Responsibility of the controller
GDPR
T05: Jatkuvuuden hallinta
Katakri
21.2.a: Risk management and information system security
NIS2
8.3: Information security risk treatment
ISO 27001
See all related requirements and other information from tasks own page.
Go to >
Documentation of linked risks for identified security incidents
List of work tasks requiring the handling of confidential information
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

T12: Tiedonsaantitarve ja käsittelyoikeudet
Katakri
HAL-10: Henkilöstön luotettavuuden arviointi
Julkri
T-13: NEED-TO-KNOW AND ACCESS RIGHTS
Katakri 2020
I-06: THE PRINCIPLE OF LEAST PRIVILEGE – MANAGEMENT OF ACCESS RIGHTS
Katakri 2020
See all related requirements and other information from tasks own page.
Go to >
List of work tasks requiring the handling of confidential information
Yleiset muutostenhallintamenettelyt (ST IV-III)
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

I20: Muutoshallintamenettelyt
Katakri
See all related requirements and other information from tasks own page.
Go to >
Yleiset muutostenhallintamenettelyt (ST IV-III)
Yleiset muutostenhallintamenettelyt (ST II)
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

I20: Muutoshallintamenettelyt
Katakri
See all related requirements and other information from tasks own page.
Go to >
Yleiset muutostenhallintamenettelyt (ST II)
Evaluation process and documentation of significant security-related changes
Critical
High
Normal
Low
Risk management
86
requirements

Examples of other requirements this task affects

Članak 30.1.a: Politike analize rizika i sigurnosti informacijskih sustava
NIS2 Croatia
7 §: Riskienhallinta
Kyberturvallisuuslaki
5.2.1: Change management
TISAX
30 § 3.1°: L'analyse des risques et à la sécurité des systèmes d'information
NIS2 Belgium
2.10.1: Include security in the organisation’s change management process
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Evaluation process and documentation of significant security-related changes
Treatment process and documentation of identified non-conformities
Critical
High
Normal
Low
Risk management
43
requirements

Examples of other requirements this task affects

10.2: Non-conformity and corrective action
ISO 27001
23: Häiriöiden- ja poikkeamienhallintaprosessi
Digiturvan kokonaiskuvapalvelu
21.4: Non-conformities and corrective actions
NIS2
CC4.2: Evaluation and communication of internal control deficiencies
SOC 2
P8.1: Periodic monitoring of privacy compliance
SOC 2
See all related requirements and other information from tasks own page.
Go to >
Treatment process and documentation of identified non-conformities
Taking the results of risk management into account in audit procedures
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

Article 6: ICT risk management framework
DORA
1.4.1: Management of Information Security Risks
TISAX
See all related requirements and other information from tasks own page.
Go to >
Taking the results of risk management into account in audit procedures
Consideration of risk management results in continuity planning
Critical
High
Normal
Low
Risk management
10
requirements

Examples of other requirements this task affects

29: Jatkuvuuteen liittyvien riskien arviointi
Digiturvan kokonaiskuvapalvelu
30: Riskeihin perustuvat jatkuvuussuunnitelmat
Digiturvan kokonaiskuvapalvelu
1.4.1: Management of Information Security Risks
TISAX
28.(1): Kiberriska pārvaldības un nepārtrauktības plāni
NIS2 Latvia
§ 10: Krav om sikkerhet for tilbydere av digitale tjenester
NIS2 NO
See all related requirements and other information from tasks own page.
Go to >
Consideration of risk management results in continuity planning
Practicing disaster plans
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

§ 13.3: Beredskapsplanlegging og øvelser
NIS2 NO
5.42: HLT – Noodcommunicatiesituaties
NEN 7510
§ 21: Beredskabsøvelser
Energisektor beredskabsbekendtgørelse
See all related requirements and other information from tasks own page.
Go to >
Practicing disaster plans
Process for including information security aspects in project management
Critical
High
Normal
Low
Risk management
5
requirements

Examples of other requirements this task affects

6.1.5: Information security in project management
ISO 27001
5.8: Information security in project management
ISO 27001
1.2.3: Information Security requirements in projects
TISAX
5.8: Informatiebeveiliging in projectbeheer
NEN 7510
See all related requirements and other information from tasks own page.
Go to >
Process for including information security aspects in project management
Assessment of the impact and likelihood of the risks and the scales used
Critical
High
Normal
Low
Risk management
17
requirements

Examples of other requirements this task affects

ID.RA-4: Impacts on business
NIST
Article 6: ICT risk management framework
DORA
2.5: Riskienhallinta
TiHL tietoturvavaatimukset
1.4.1: Management of Information Security Risks
TISAX
ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk
CyberFundamentals
See all related requirements and other information from tasks own page.
Go to >
Assessment of the impact and likelihood of the risks and the scales used
Approval of the risk management procedure description
Critical
High
Normal
Low
Risk management
11
requirements

Examples of other requirements this task affects

ID.RM-1: Risk management processes
NIST
Article 6: ICT risk management framework
DORA
1.4.1: Management of Information Security Risks
TISAX
ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders.
CyberFundamentals
GV.RM-01: Establishing and agreeing on risk management objectives with stakeholders
NIST 2.0
See all related requirements and other information from tasks own page.
Go to >
Approval of the risk management procedure description
Risk level accepted by the organization
Critical
High
Normal
Low
Risk management
57
requirements

Examples of other requirements this task affects

ID.RM-2: Risk tolerance
NIST
ID.RM-3: Informing of risk tolerance
NIST
6.1: Information security risk management
ISO 27001
RISK-1: Establish and Maintain Cyber Risk Management Strategy and Program
C2M2
21.2.a: Risk management and information system security
NIS2
See all related requirements and other information from tasks own page.
Go to >
Risk level accepted by the organization
Evaluation of the information security measures defined in the risk management phase
Critical
High
Normal
Low
Risk management
8
requirements

Examples of other requirements this task affects

HAL-06: Riskienhallinta
Julkri
RISK-4: Respond to Cyber Risk
C2M2
CC5.1: Control activities for mitigation of risks
SOC 2
1.4.1: Management of Information Security Risks
TISAX
Article 31: ICT risk management
DORA simplified RMF
See all related requirements and other information from tasks own page.
Go to >
Evaluation of the information security measures defined in the risk management phase
Legal risks related to the service
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

HAL-06.1: Riskienhallinta - lainsäädäntöjohdannaiset riskit
Julkri
See all related requirements and other information from tasks own page.
Go to >
Legal risks related to the service
Assessment of physical security risks
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

FYY-01: Fyysisen turvallisuuden riskien arviointi
Julkri
F-02: RISK ASSESSMENT OF PHYSICAL SECURITY MEASURES
Katakri 2020
8 §: Kyberturvallisuutta koskeva riskienhallinnan toimintamalli
Kyberturvallisuuslaki
See all related requirements and other information from tasks own page.
Go to >
Assessment of physical security risks
Change management procedures in information processing environments (CL IV)
Critical
High
Normal
Low
Risk management
2
requirements

Examples of other requirements this task affects

TEK-17.3: Muutoshallintamenettelyt
Julkri
I-16: SECURITY THROUGHOUT THE INFORMATION PROCESSING ENVIRONMENT LIFE CYCLE - CHANGE MANAGEMENT
Katakri 2020
See all related requirements and other information from tasks own page.
Go to >
Change management procedures in information processing environments (CL IV)
Immediate reporting of critical risks to top management
Critical
High
Normal
Low
Risk management
3
requirements

Examples of other requirements this task affects

18: Kriittisten riskien raportointi
Digiturvan kokonaiskuvapalvelu
1.1.3: Identify the organisation’s processes for ICT risk management
NSM ICT-SP
Article 56: Measures to effect rectification and eliminate hidden dangers
CSL (China)
See all related requirements and other information from tasks own page.
Go to >
Immediate reporting of critical risks to top management
Monitoring the status of risk management
Critical
High
Normal
Low
Risk management
15
requirements

Examples of other requirements this task affects

19: Riskienhallinan tilanteen seuraaminen
Digiturvan kokonaiskuvapalvelu
CC5.1: Control activities for mitigation of risks
SOC 2
Article 6: ICT risk management framework
DORA
2.5: Riskienhallinta
TiHL tietoturvavaatimukset
1.1.3: Identify the organisation’s processes for ICT risk management
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Monitoring the status of risk management
Consideration of critical functions in risk management
Critical
High
Normal
Low
Risk management
8
requirements

Examples of other requirements this task affects

74: Kriittisten palveluiden riskien arviointi ja hallinta
Digiturvan kokonaiskuvapalvelu
ID.BE-4: Dependencies and critical functions for delivery of critical services are established.
CyberFundamentals
§ 31: Besondere Anforderungen an die Risikomanagementmaßnahmen von Betreibern kritischer Anlagen
NIS2 Germany
12.1: Risk assessments
CER
§ 13: Riskbedömning
NIS2 Åland
See all related requirements and other information from tasks own page.
Go to >
Consideration of critical functions in risk management
Identification of risks endangering the continuity of operations and their handling plans
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

CC9.1: Treatment plans for business disruption risks
SOC 2
28.(1): Kiberriska pārvaldības un nepārtrauktības plāni
NIS2 Latvia
See all related requirements and other information from tasks own page.
Go to >
Identification of risks endangering the continuity of operations and their handling plans
Consideration of information security goals in risk assessment
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

CC5.1: Control activities for mitigation of risks
SOC 2
30 § 2°: Évaluation des risques et mesures de gestion
NIS2 Belgium
§ 7: Risikovurdering
NIS2 NO
5.19: Informatiebeveiliging in relaties met leveranciers
NEN 7510
See all related requirements and other information from tasks own page.
Go to >
Consideration of information security goals in risk assessment
Segregation of tasks in information security risk management
Critical
High
Normal
Low
Risk management
1
requirements

Examples of other requirements this task affects

CC5.1: Control activities for mitigation of risks
SOC 2
See all related requirements and other information from tasks own page.
Go to >
Segregation of tasks in information security risk management
Regular external auditing of security practices
Critical
High
Normal
Low
Risk management
40
requirements

Examples of other requirements this task affects

18.2.1: Independent review of information security
ISO 27001
5.35: Independent review of information security
ISO 27001
51: Tietoturvallisuuden auditointi
Digiturvan kokonaiskuvapalvelu
21.2.f: Assessing effectiveness of security measures
NIS2
CC4.1: Evaluation of internal controls
SOC 2
See all related requirements and other information from tasks own page.
Go to >
Regular external auditing of security practices
Detection of non-compliance with the change management procedure
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

CC3.4: Identification and assesment of changes
SOC 2
ID.IM-01: Improvements from evaluations
NIST 2.0
See all related requirements and other information from tasks own page.
Go to >
Detection of non-compliance with the change management procedure
Rules for deviating from the change management procedure
Critical
High
Normal
Low
Risk management
4
requirements

Examples of other requirements this task affects

CC3.4: Identification and assesment of changes
SOC 2
5.2.1: Change management
TISAX
See all related requirements and other information from tasks own page.
Go to >
Rules for deviating from the change management procedure
Regular communication of the general risk situation to the organization's management
Critical
High
Normal
Low
Risk management
5
requirements

Examples of other requirements this task affects

17: Riskitilanteen raportointi johdolle
Digiturvan kokonaiskuvapalvelu
CC3.2: Identification of risks related to objectives
SOC 2
1.1.4: Identify the organisation’s tolerances for ICT risk
NSM ICT-SP
GV.RM-05: Communication lines for cybersecurity risks across the organization
NIST 2.0
See all related requirements and other information from tasks own page.
Go to >
Regular communication of the general risk situation to the organization's management
Assessment of residual risks
Critical
High
Normal
Low
Risk management
40
requirements

Examples of other requirements this task affects

20: Jäännösriskien arviointi
Digiturvan kokonaiskuvapalvelu
21.2.a: Risk management and information system security
NIS2
2.5: Riskienhallinta
TiHL tietoturvavaatimukset
7 §: Riskienhallinta
Kyberturvallisuuslaki
ID.GV-4: Governance and risk management processes address cybersecurity risks.
CyberFundamentals
See all related requirements and other information from tasks own page.
Go to >
Assessment of residual risks
Continuous improvement of the risk management process
Critical
High
Normal
Low
Risk management
41
requirements

Examples of other requirements this task affects

21: Riskienhallintaprosessin kehittäminen
Digiturvan kokonaiskuvapalvelu
21.2.a: Risk management and information system security
NIS2
Article 6: ICT risk management framework
DORA
1.4.1: Management of Information Security Risks
TISAX
8 §: Kyberturvallisuutta koskeva riskienhallinnan toimintamalli
Kyberturvallisuuslaki
See all related requirements and other information from tasks own page.
Go to >
Continuous improvement of the risk management process
Consideration of partner risks in information security risk management
Critical
High
Normal
Low
Risk management
5
requirements

Examples of other requirements this task affects

CC9.2: Partner risk management
SOC 2
1.3.3: Use of approved external IT services
TISAX
30 § 2°: Évaluation des risques et mesures de gestion
NIS2 Belgium
19.2.i (risk management): Insider risk management
NIS2 Malta
12.1: Mesures de sécurité et gestion des risques
NIS2 Luxembourg
See all related requirements and other information from tasks own page.
Go to >
Consideration of partner risks in information security risk management

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way‍
Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
Do it once - we automatically apply it to all current and future frameworks.
Start free trial
Get to know Cyberday
Start your free trial
Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
Clear framework compliance plans
Activate relevant frameworks and turn them into actionable policies tailored to your needs.
Credible reports to proof your compliance
Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
AI-powered improvement suggestions
Focus on the most impactful improvements in your compliance with help from Cyberday AI.
Effortless compliance improvement
Widest framework library in EU
Extensive support

Get your compliance
foundation in minutes.

Learn what an AI-powered ISMS looks like in practice.
Start a free trial and see your compliance work launch in minutes.

Start free trial
Book a meeting
How it works?
SummarySecurity tasks and assuranceDocumentation workflowsEmployee guidelinesReporting templatesTrust center
Use cases
By frameworkAll frameworksISO 27001NIS2 directiveNIST CSFCSA CCMISO 27701GDPRISO 27017ISO 27018
By methodCyber risk managementEmployee awarenessCompliance reportingControl managementAsset managementPrivacy managementVendor assessmentsInternal audits
Resources
AcademyWebinarsBlogHelp articlesVideo coursesTrust centerContent libraryGuidesNewsletterLeave a reviewPartner programTeamTerms of usePrivacy policy
Contact us
+358 10 231 6010
team@cyberday.ai
App works in:
Known in Finland as Digiturvamalli
© Cyberday Inc. Kalevantie 2 33100 Tampere, Finland
Cyberday.ai - Improve and certify your cyber security
No items found.