Risk management, aligned to ISO 31000 & NIST RMF
Identify, assess and treat cybersecurity risk across people, process and technology — with a living risk register, a treatment plan, and continuous monitoring.
Risk management is the process of identifying, assessing and treating risk to your information. Passeca runs the full cycle — context, identification, analysis, treatment and monitoring — aligned to ISO 31000 and the NIST Risk Management Framework, leaving you a living risk register, a prioritised treatment plan and board-ready reporting on residual risk.
What is risk management?
Cybersecurity risk management is the systematic process of identifying, analysing, evaluating and treating risks to the confidentiality, integrity and availability of your information assets. It is the discipline that decides where you spend your security budget — by ranking risks against your business objectives and your appetite, and treating the ones that matter most.
Two methodologies dominate. ISO 31000 is the international standard for risk management, providing principles and a framework that works for any risk type. The NIST Risk Management Framework (RMF, SP 800-37) is a control-driven process that links risk directly to the selection and monitoring of security controls. Passeca uses ISO 31000 for the risk method and the NIST RMF where you need control mapping — and feeds both with live threat intelligence from Signals and vulnerability data from your estate.
Who needs risk management?
- You need to satisfy a regulation. NIS2, DORA, ISO 27001 and SOC 2 all require a documented risk assessment.
- You have a security budget to justify. Risk management tells you what to spend it on first.
- Your board asks "what is our risk?" A risk register is how you answer in business language.
- You have a point-in-time risk assessment that is stale. Continuous risk management keeps it current.
What does risk management actually involve?
A risk-management programme follows a cycle. Each phase has concrete outputs that feed the next, and the cycle repeats continuously rather than annually.
- Establish the context — define the scope, the assets, the business objectives and the risk appetite that scores are measured against.
- Identify risks — what could happen, to what asset, from what threat, via what vulnerability.
- Analyse risks — score each risk for likelihood and impact, qualitatively or quantitatively.
- Evaluate risks — compare scores to appetite and decide what to treat.
- Treat risks — mitigate (controls), transfer (insurance), avoid (stop the activity) or accept (document the decision).
- Monitor and review — re-score as the landscape changes and track treatment to completion.
- Communicate and consult — report residual risk to leadership in business language.
The output is a risk register — the single living document your security programme is built on, and the artefact auditors and regulators ask to see.
How Passeca runs a risk-management engagement
- 01
Context & scope
We establish the context — your business objectives, assets, threat landscape and risk appetite — so every risk is scored against what actually matters to your organisation, not a generic scale.
- 02
Risk identification
We identify risks across people, process and technology — using threat intelligence (Signals), vulnerability data, asset inventories and structured workshops with your teams.
- 03
Risk analysis & evaluation
We score each risk for likelihood and impact against your appetite, producing a prioritised risk register that ranks what to treat first. The register becomes the single source of truth for your security programme.
- 04
Risk treatment
We design the treatment plan — mitigate, transfer, avoid or accept — for every risk above your appetite, with owners, dates and the controls that close the gap. We implement the technical measures with you.
- 05
Continuous monitoring & review
We keep the register alive — re-scoring risks as the threat landscape changes, tracking treatment progress, and reporting residual risk to leadership on a defined cadence.
What you get from the engagement
ISO 31000 vs NIST RMF vs ISO 27001 risk
Three related but distinct risk approaches, and when each applies.
| ISO 31000 | NIST RMF | ISO 27001 | |
|---|---|---|---|
| Type | Risk method | Control framework | ISMS standard |
| Risk assessment | |||
| Control selection | Method only | Annex A | |
| Continuous monitoring | Surveillance | ||
| Certification | No | No (US fed) | |
| Best for | Any risk | US / control-driven | Certification |
ISO 31000 provides the risk method; the NIST RMF adds control selection and monitoring; ISO 27001 turns the output into a certifiable management system. Passeca uses ISO 31000 as the foundation and layers the others as your regulatory and certification needs require.
Risk management, answered
The questions buyers ask before starting a risk-management engagement.
What is cybersecurity risk management?
What are ISO 31000 and the NIST RMF?
What is a risk register, and why do we need one?
What is risk appetite, and why does it matter?
How does risk management relate to compliance?
How often should a risk assessment be updated?
Do you provide a vCISO to own the risk register?
How much does risk management cost?
Turn your risk register into a decision tool
Book a free scoping call. We will review your current risk approach, define your appetite with leadership, and give you a timeline and cost band for a living risk register.
Related