guidance

Risk management

This guidance is intended to help you better understand and manage the cyber security risks affecting your organisation.
Invalid DateTime

PAGE 1 OF 15

Change
Risk management

PAGE 1 OF 15

Introduction

This page introduces the intent behind the NCSC's risk management guidance, and how to best use it.

Our economy, society and individual lives have been transformed by digital technologies. They have enabled improvements in science, logistics, finance, communications, and a whole range of other essential activities.

However, these digital technologies that we now depend upon are vulnerable to attack, misuse, and abuse. They contain bugs, faults and weaknesses that can be exploited by attackers in ways that pose cyber security risk to the systems, services, and information we care about.

This guidance is intended to help you better understand and manage the cyber security risks affecting your organisation.


Who is this guidance for ?

This guidance is primarily aimed at cyber security risk practitioners who help their organisations understand and make decisions about cyber security risks. It will also be helpful to people who want to set up an effective cyber security risk management function within their organisation for the first time (or those seeking to improve existing functions).


What does this guidance cover ?

The guidance will first introduce some core some risk management concepts. It then proposes a framework of high-level steps that could be used to form the basis of any cyber security risk management process.

To support this framework, more detailed guidance is provided to:

  • help readers understand what 'good risk management governance looks like'
  • introduce the idea of building and maintaining a risk management 'toolbox'

For readers who are new to cyber security risk management (or don’t know where to start), we’ve also included a basic risk assessment method, with clear guidance on its limitations.

More experienced practitioners will benefit from the sections on:


Navigating this guidance

The diagram below shows how this collection of guidance is structured. The introduction, fundamentals and framework sections should be read by all readers. The rest of the collection can be read based on the readers experience and requirements.


Make cyber security risk management useful and meaningful

Improving business outcomes should be the primary driver for cyber security risk management. We advocate meaningful cyber security risk management that illuminates the real cyber risks that are applicable to your organisation and how it operates, rather than the use of techniques which just seek to satisfy compliance requirements.

For these reasons, this collection of guidance is not prescriptive. No single technique in this guidance will be useful in every situation. It is therefore important that you take care to understand why you have chosen the cyber security risk management techniques, methods and approaches you use, and how they can help you and your organisation better understand the cyber security risks you face.

The fundamentals and basics of cyber risk