12 new national NIS2 framework versions published! Read more ->
Cyberday back to normal - related blog
The organization shall conduct risk assessments in which risk is determined by threats, vulnerabilities and impact on business processes and assets.
Guidance
- Keep in mind that threats exploit vulnerabilities.
- Identify the consequences that losses of confidentiality, integrity and availability may have on the assets and related business processes.
The organization shall conduct and document risk assessments in which risk is determined by threats, vulnerabilities, impact on business processes and assets, and the likelihood of their occurrence.
Guidance
- Risk assessment should include threats from insiders and external parties.
- Qualitative and/or quantitative risk analysis methods
(MAPGOOD, ISO27005, CIS RAM, …) can be used together with software tooling.
Risk assessment results shall be disseminated to relevant stakeholders.
The organization proactively seeks to list and assess the likelihood and severity of various cyber security risks. The documentation shall include the following:
The organization has defined procedures for assessing and treating cyber security risks. The definition includes at least:
The task owner regularly checks that the procedure is clear and produces consistent results.
As part of the security risk assessment, the organization shall make assessments of the severity and probability of the risk materializing.
The organization shall have a clearly instructed risk scale that allows each participant in the risk assessment to decide on the appropriate level of severity and probability.
.png)
