Six risk methods, sorted by the altitude they work at.

The NIST row hides two companions, SP 800-39 and SP 800-30, which is why the count reaches six. They work together, so the next section treats them as one family.

SP 800-39

Organisation-wide risk work in four parts, frame, assess, respond, monitor, carried out at three levels: the whole organisation, its business processes, and its systems.

SP 800-30 Rev. 1

The working manual for one risk assessment: prepare, run it, share the results and keep it current, with likelihood and impact scales you can adapt.

SP 800-37 Rev. 2 (RMF)

Seven steps across a system's life: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor. The controls come from SP 800-53.

• Prepare
• Categorize
• Select
• Implement
• Assess
• Authorize
• Monitor

The RMF and the CSF solve different problems. The CSF describes results for a whole programme; the RMF governs how one system earns approval to operate. US federal bodies run both.

ISO 31000 offers principles, a framework for building risk work into how the organisation is run, and a process: set the context, assess, decide on treatment, with communication and monitoring wrapped around every stage. It serves safety, finance and reputation as readily as security. Nobody is certified against it.

ISO/IEC 27005 takes that grammar and points it at information. It is the usual method behind the risk assessment and risk treatment that ISO/IEC 27001 clauses 6.1.2, 6.1.3, 8.2 and 8.3 call for. The 2022 edition describes two ways in: start from events that could hurt the business, or start from assets and their weak points.

• Certifying to ISO/IEC 27001. Adopt ISO/IEC 27005. The certification auditor will sample your assessment and treatment plan.
• Selling to US federal agencies. Plan for the RMF and SP 800-53 controls, often through FedRAMP for cloud services.
• A listed company with COSO controls. Fold cyber into COSO ERM so it reaches the same committee as every other risk.
• Many risk types, no single regulator. Use ISO 31000 as the common vocabulary and add a security method under it.
• A budget argument with finance. Run FAIR on the top few scenarios so the debate happens in money.

1. The board uses ISO 31000 terms for every risk, from fraud to staff attrition.
2. The security team scores information risks with ISO/IEC 27005, because the company is certifying to ISO/IEC 27001.
3. For its two largest cyber scenarios, ransomware and a card-data leak, the finance head asks for FAIR estimates to size cyber insurance.
4. All three feed one risk register, so each risk has a single owner and a single treatment decision.

• A register opened once a year. Risk shifts with products, suppliers and threats. A refresh the week before an audit misses most of it.
• Scores with no scale. If two people mean different things by 'high', nothing has been measured. Write down what each level means.
• Acceptance by silence. Accepting a risk is a decision. Record who accepted it, why, and when it will be looked at again.

Sources: NIST SP 800-37 Rev. 2, SP 800-30 Rev. 1 and SP 800-39; NIST Cybersecurity Framework 2.0; public summaries of ISO 31000:2018 and ISO/IEC 27005:2022 on iso.org; ISO/IEC 27001:2022 clause titles; COSO, Enterprise Risk Management: Integrating with Strategy and Performance (2017); The Open Group FAIR standards (O-RA, O-RT).