Risk Management Policy

1. Purpose

This policy sets out how the Organisation identifies, analyses, evaluates, treats, accepts, monitors and communicates information security risk. It gives one method, with fixed scales and tables, so that two assessors rating the same risk reach the same answer and so that top management can compare risks across the Organisation.

• Establish risk acceptance criteria and the authority needed to accept each level of risk.
• Make risk assessment repeatable, valid and comparable year on year.
• Link every control in the Statement of Applicability to a risk or a requirement.
• Give risk owners clear duties and a deadline for each decision.

2. Scope

The policy applies to all information, in any form, and to the assets that create, store, process or transmit it: people, premises, hardware, software, services, suppliers and processes within the ISMS scope in the ISMS Manual. It applies to all employees, contractors and suppliers who own, assess or treat risk.

• In scope: the annual assessment, assessments triggered by change, project, supplier or product assessments, site assessments, and risks raised from audits, incidents and threat intelligence.
• In scope: risks to the confidentiality, integrity and availability of information, including privacy risks to individuals whose personal data the Organisation handles.
• Out of scope: enterprise financial, strategic and market risks, which are managed under [the enterprise risk management framework]. Where such a risk depends on information security it is raised here and cross-referenced.

3. Terms and Definitions

4. Roles and Responsibilities

5. Risk Management Policy Statements

5.1 Governance and accountability

• Top management approves the risk appetite statement and the risk acceptance criteria in this policy at least every [12 months], and whenever the strategy or the threat landscape changes materially.
• Every risk on the register has a named risk owner who has the authority and budget to treat it or the authority to accept it. A risk without an owner is escalated to the Head of Information Security within [five working days].
• The risk manager reports the risk position to the Information Security Steering Committee [quarterly] and to top management at each management review.
• Nobody may accept a risk they created for their own benefit or approve the treatment of a risk in which they have a conflict of interest.

5.2 Risk appetite

The Organisation will not retain a risk that could lead to loss of control of customer or personal data at scale, serious harm to individuals, breach of law or contract with significant consequences, or loss of a critical service beyond its recovery objective. It accepts low risks as a normal part of operating, and medium risks where the cost of further control exceeds the benefit and the risk owner accepts them in writing.

• High and critical risks are outside appetite and must be treated or formally accepted by top management with an end date.
• Appetite is stated per category: [data confidentiality: low; service availability: low to medium; internal efficiency: medium].

5.3 Assessment

• A full assessment of all in-scope assets is performed at least every [12 months], and the register is updated at least [quarterly] in between.
• An assessment is also performed before go-live of a new service, system or supplier of critical services; on a significant change; after a high or critical incident; and when new threat or vulnerability information shows a rating is wrong.
• Every assessment uses the scales, tables and templates in this policy. Departures need the approval of the Head of Information Security.
• Assessors must be trained in the method. Asset owners must agree the valuation of their assets.
• Assessments must consider personal data risks to individuals as well as risks to the Organisation. A data protection impact assessment is required where the Data Protection and Privacy Procedure says so.

5.4 Treatment and acceptance

• Every risk above the low band has a treatment decision recorded within the deadlines in the acceptance criteria table.
• Treatment is chosen by comparing the cost and effect of options; the chosen controls are compared with Annex A so that no necessary control is missed, and the Statement of Applicability is updated.
• A risk may be accepted only by a person with the authority in the acceptance criteria table, in writing, with a review date no later than [12 months] and sooner for higher bands.
• Treatment actions overdue by more than [30 days] are escalated to the Information Security Steering Committee.

5.5 Monitoring, change and communication

• Risk owners review their risks at the frequency in the acceptance criteria table and confirm the rating is still right.
• A risk register entry is reopened if an incident, audit finding, vulnerability, change or threat report shows the rating or controls are no longer valid.
• Risk information is shared with those who need it to make decisions. Detailed risk register content is classified [Confidential] under the Information Classification and Handling Policy.
• The risk register is the single source for risk; separate lists kept in teams or projects must be merged into it at least [quarterly].

6. Risk Assessment Method

The method below is the Organisation's risk assessment procedure. The risk manager runs it; asset owners and risk owners take part. It follows the order: context and criteria, assets and value, threats, vulnerabilities, likelihood, impact, risk value, existing controls, evaluation, treatment, acceptance, monitoring.

6.1 Overview of the assessment cycle

1. PrepareThe risk manager confirms scope, scales and participants, refreshes the asset register and the threat and vulnerability inputs. Output: assessment plan. Time target: [10 working days] before the cycle.
2. Identify and value assetsAsset owners list assets in their area and rate confidentiality, integrity and availability. Output: valued asset register. Time target: [15 working days].
3. Identify threats and vulnerabilitiesThe assessor with the control owner selects the credible threats for each asset and rates the vulnerabilities. Output: scenario list. Time target: [15 working days].
4. Rate riskThe assessor derives likelihood and impact, calculates the inherent risk, records existing controls and calculates residual risk. Output: draft register. Time target: [10 working days].
5. Review ratingsRisk owners confirm ratings. The risk manager moderates for consistency across areas. Output: agreed register. Time target: [5 working days].
6. Decide treatmentRisk owners choose treatment and accept or reject residual risk within authority. Output: treatment plan and acceptances. Time target: per the acceptance criteria table.
7. Report and monitorThe risk manager reports to the ISSC and top management and tracks actions to closure. Output: risk report.

6.2 Context and criteria

Before each cycle the risk manager confirms the criteria that the assessment will use: the scales in this policy, the risk appetite, the legal and contractual requirements from the Internal and External Issues and Interested Parties statement, and the assessment period, which is [12 months] ahead. Changes to the scales are approved by top management and apply to the whole register from the next cycle so that results stay comparable.

6.3 Asset identification and grouping

Assets are taken from the asset register kept under the Asset Management Procedure. An asset that is not on the register is added before it is assessed. Similar assets that share threats, vulnerabilities and value (for example all laptops) are grouped to keep the register usable, but any asset with a higher value or a unique weakness is assessed alone.

6.4 Assigning asset value

Each asset is valued for confidentiality, integrity and availability on a scale of 1 to 5. The asset owner proposes the rating, using the highest rating whose description fits, and the risk manager moderates. The value of an asset is the highest of the three ratings.

6.4.1 Confidentiality rating

6.4.2 Integrity rating

6.4.3 Availability rating

6.4.4 Asset value and criticality class

Asset value = the highest of the confidentiality, integrity and availability ratings. The value sets the criticality class, which decides the depth of control and the frequency of review.

The confidentiality rating drives the information classification label under the Information Classification and Handling Policy: 1 is [Public], 2 is [Internal], 3 is [Confidential], 4 is [Restricted] and 5 is [Highly restricted]. Where the label and the rating differ, the higher applies.

6.5 Threat identification

A threat is considered for an asset only if it is credible for that asset. Inputs are the threat catalogue below, incident history, reports from the national computer emergency response team and sector bodies, the output of the Threat Intelligence Policy, penetration test results, audit findings and the experience of control owners. Each threat is rated from 1 to 3.

6.6 Vulnerability identification

Vulnerabilities are identified by the control owner with the assessor from vulnerability scans and penetration tests, configuration reviews, audit and assessment findings, incident root causes, process walk-throughs and supplier reports. A vulnerability is rated for the asset and the specific threat, not in general.

6.7 Likelihood

Likelihood is derived from the threat and vulnerability ratings so that it is not simply a guess. It is threat rating plus vulnerability rating minus 1, giving a value from 1 to 5. The assessor may move it one step up or down with a written reason, for example recent incidents or a compensating control not captured.

6.8 Impact

Impact is the consequence if the scenario occurs. It starts from the value of the property of the asset that is compromised: if the threat affects confidentiality the impact starts at the confidentiality rating, integrity at the integrity rating, availability at the availability rating. The assessor then checks the result against the table, which sets the consequence across several dimensions, and may adjust by one step with a written reason.

6.9 Risk value and risk matrix

Risk value = Likelihood x Impact, giving 1 to 25. The matrix below shows the score and the band for each combination. Bands: Low 1 to 4; Medium 5 to 9; High 10 to 16; Critical 20 to 25.

6.10 Existing controls and residual risk

The assessor records the controls that currently operate against the scenario. The score calculated from threat and vulnerability ratings already allows for them, because the vulnerability rating reflects control strength. The inherent risk is calculated by rating the vulnerability as 3 (High), as if no control existed; the residual risk is calculated with the real vulnerability rating.

• If a control is documented but untested, not operated, or evidence shows it failed, the vulnerability rating is 3 and residual risk equals inherent risk.
• If no controls exist, or the controls are inadequate for the threat, the risk is defined as the inherent risk and must be treated.
• A planned control does not reduce residual risk until it is implemented and tested. The expected residual risk after treatment is recorded separately in the treatment plan as the target risk.

6.11 Worked example

The example shows the calculation for one scenario. The values are illustrative.

7. Risk Acceptance Criteria and Risk Owners

A risk is evaluated against the criteria below once its residual score is known. The risk owner for each risk is the most senior person who has authority over the asset or process and over the budget to treat the risk; the asset owner is the default. Authority to accept rises with the band.

7.1 Risk owner duties

• Confirm the scenario, ratings and controls recorded for each assigned risk.
• Choose a treatment option within the deadline and fund it, or accept the risk within authority.
• Sign the acceptance record (Annexure D) with the reasons, the end date and the conditions.
• Review the risk at the frequency above and whenever the context changes.
• Notify the risk manager at once if the risk or its controls change.

8. Risk Treatment

8.1 Treatment options

Sharing does not remove the Organisation's accountability for its own data. Where a supplier runs the control the Organisation retains the risk of the supplier failing and treats it under the Supplier Relationship Management Policy.

8.2 Treatment process

1. Select optionThe risk owner picks the option with the risk manager's advice, comparing cost, effort, time to effect and the target risk. Time target: per the acceptance criteria table.
2. Determine controlsThe control owner and risk manager list the controls needed, from Annex A and other sources, and compare them with Annex A to confirm none has been left out. Output: control list.
3. Write the planThe risk manager records the actions, owner, due date, budget, dependencies and target risk in the risk treatment plan (Annexure C).
4. AuthoriseThe plan is approved by the authority in the acceptance table. High and critical plans go to the ISSC and top management. Time target: [10 working days].
5. ImplementControl owners complete the actions. Progress is reviewed by the risk manager [monthly]. Output: evidence of implementation.
6. VerifyThe control is tested to show it works (a test, an inspection or a review of records). The risk is re-rated. Output: updated register.
7. Accept residual riskThe risk owner signs the residual risk acceptance using the authority table. If the residual risk is still above appetite, the cycle repeats.
8. Update the Statement of ApplicabilityThe Head of Information Security updates the Statement of Applicability so that every applicable control is justified by a risk or a requirement.

8.3 Prioritisation

Treatment is sequenced by band first, then by the number of risks a single control addresses, then cost. A control that removes several high risks takes precedence over one that removes a single medium risk. Quick actions that cost under [a set amount] and remove a high risk are done without waiting for the cycle.

8.4 Management authorisation

Top management approves the risk treatment plan and accepts the residual risks it leaves. The approval is recorded with the date, the version of the plan and the list of risks accepted. Approval is repeated when the plan changes materially, and the acceptance of any single risk lapses on its end date.

9. Site Risk Assessment

Each site in the ISMS scope is assessed for physical and environmental risk [every 12 months], before a new site is taken into use, and after a significant change to the site, a relevant incident or a change in the local threat. The assessment follows the same scales and bands. The detailed controls are in the Physical and Environmental Controls Policy and the Physical and Environmental Security Procedure.

10. Other Risk Assessments

The same method applies to assessments that arise from other processes. Each produces entries in the same register.

11. Risk Monitoring, Review and Reporting

Risks change as the threats, the controls and the business change. The risk manager keeps the register current and reports on it.

11.1 Triggers for reassessment

• A high or critical incident, or three or more medium incidents with the same cause within [90 days].
• A vulnerability rated critical that cannot be fixed within the patch window set in the Patch Management Policy.
• A new service, system, supplier or location, or a change in the use of existing assets.
• A change in law, regulation, contract or customer requirement, including those recorded in the Internal and External Issues and Interested Parties statement.
• An internal or external audit finding that shows a control did not work.
• A change in the threat picture reported through threat intelligence or the national computer emergency response team.

11.2 Risk reporting

The risk manager issues a risk report to the Information Security Steering Committee [quarterly] and to top management with the management review. The report shows risks by band, new and closed risks, overdue treatment actions, risks accepted and their end dates, key risk indicators and the top [10] risks with owner and status.

11.3 Key risk indicators

12. Compliance and Monitoring

• The risk manager checks every [quarter] that all risks have an owner, a rating dated within the review period and a treatment decision within deadline, and reports exceptions to the ISSC.
• The internal audit lead tests the method [every 12 months] by sampling assessments, re-performing ratings and checking treatment evidence against what the register states.
• The Head of Information Security reviews the scales, the acceptance criteria and the threat catalogue with the ISSC [every 12 months] to confirm they still fit the Organisation.
• Any risk accepted outside the authority in this policy is a nonconformity and is handled under the corrective action process in the ISMS Manual.

13. Records and Evidence

14. Measures

15. Procedures and Related Documents

This policy contains the full risk assessment method. The Asset Management Procedure supplies the asset register that feeds step one of the method. Controls selected through treatment are traced to the Statement of Applicability, and the results are reviewed under the ISMS Manual. Product-level assessments follow the Product Risk Assessment Procedure.

Annexure A: Asset register template

Annexure B: Risk register template

Annexure C: Risk treatment plan template

Annexure D: Risk acceptance record

Annexure E: Site risk assessment checklist

16. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

17. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

18. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Information Security Policy
• ISMS Manual
• Statement of Applicability
• Asset Management Procedure
• Product Risk Assessment Procedure
• Information Classification and Handling Policy
• Supplier Relationship Management Policy
• Physical and Environmental Controls Policy