Risk Management

Intent of this Standard

Organisations must actively identify, assess, and manage risks across the business as part of their day-to-day operations, including cyber security risks. The primary purpose of a defined risk management approach is to allow for a common understanding of risks and threats, their impact, and to take the appropriate measures to reduce impacts, in case they eventuate, to an accepted level.

By implementing this Standard, organisations will be able to ensure identified risks have adequate measures in place to mitigate those risks to pre-agreed levels. In particular, they will:

• have clearly defined acceptable residual risk levels to help inform mitigation and investment decisions,
• ensure risks are identified and managed beyond the traditional business and financial risks,
• have cyber security risk handled as part of the organisation’s risk. management, rather than separately,
• continually track mitigated risks and the management of any residual risk,
• obtain assurance that their current and planned mitigations are adequately designed to meet the changing threat landscape,
• ensure that security assurance activities effectively identify emerging threats and trends that may have an adverse impact, and
• ensure that accountability, responsibility, and ownership of risks are clearly assigned to those who have control over the system/risk management.

Implementing these activities will assist organisations to protect data and ensure availability, enabling operational activities to continue unimpeded.

Minimum capability maturity level

We have established criteria within a maturity model to provide clarity, including the expected minimum implementation level, which is CS-CMM 2.

Cyber Security Capability Maturity Model

The requirements are intended to meet and comply with each respective level of maturity. The levels provide a pathway that can be used by agencies to assess themselves against, with a view to improving maturity over time.

Each maturity level builds on the requirement from the preceding level.

Below are the requirements for each capability maturity level for this Standard.

Focus areas

Focus areas are applicable to the Standard and are provided as a guide and not an exhaustive list. Each agency is best placed to identify areas of relevance.

The focus areas for this Standard are:

• Business-critical systems.
• Externally facing systems.

Suggested actions

The following list is not exhaustive. Organisations should identify which actions are appropriate to implement the Standard based on their current maturity level. However, the following actions follow good practice guidelines:

• Adopt an industry-standard risk management approach for the organisation (for example ISO 31000 or the NIST Risk Management Framework).
• Develop risk tolerance levels with executive and governance to help inform the organisation's risk mitigation strategies.
• Define accountabilities and ownership within the organisation for risk, including those for cyber security risk.
• Risk remediation is prioritised and undertaken according to a combined likelihood and impact assessment, and the organisation’s defined risk appetite.
• Cyber security risk profiles are regularly reviewed and updated to reflect an organisation’s risk exposure.
• Cyber security policies and procedures are developed and implemented to assist organisations to meet business outcomes.

Key dependencies

To implement this Standard, there are likely to be requisite measures or technologies in place.

A number of dependencies apply to multiple standards. In general, these dependencies are less technology-specific and relate to business processes.

Key dependencies for this Standard include:

• A digital asset inventory exists and is kept up to date.
• Channels for identifying, assessing, and reporting threats and risks exist.
• Organisations have identified their critical information and digital assets.

Measurable outcomes

To establish whether the Standard is being implemented, the outcomes are a tool an organisation may wish (or already have in place) to measure to help make this determination.

The outcomes have been designed to align with the requirements contained in the maturity level.

Outcomes for this Standard include:

• An industry-standard risk management approach is used by the organisation.
• Risk assessments are undertaken regularly, the results are reported, and areas for improvement are actioned.
• Risk and associated mitigations are prioritised, reflecting the organisation's risk appetite and risk evaluation.
• Risks have clearly defined owners and regular review dates.
• An organisation can demonstrate a coordinated approach to identifying new and emerging threats across the cyber landscape.
• Supply chain risks are identified, assessed, and managed as part of the wider risk management program.
• Cyber security risks are handled as part of the organisation’s wider risk management process. These broadly cover physical security, personnel security, and information security.
• Emerging threats and vulnerabilities are mapped for relevance back to an organisation’s cyber risk profile.
• Existence of formalised risk acceptance through certification and accreditation policy and procedures.