Risk management

Our lives have been transformed by digital technologies but they are vulnerable to attack, misuse, and abuse. Attackers can exploit weaknesses which poses a risk to the systems, services and information on which we depend.

The NCSC has guidance to help you understand and manage the cyber security risks to your organisation.

This guidance is for cyber security risk practitioners who help their organisations understand and make decisions in this area. It will also be helpful to people who are setting up a cyber security risk management function in their organisation for the first time, or looking to improve existing functions.

The guidance introduces some core risk management concepts. It then provides a framework of high-level steps that can be used to form the basis of any cyber security risk management process.

To support this framework, more detailed guidance is provided to:

• help readers understand the principles of good risk management governance
• introduce the idea of building and maintaining a risk management 'toolbox'

If you are new to cyber security risk management, or don’t know where to start,  a basic risk assessment method is included, with clear guidance on its limitations.

More experienced practitioners will benefit from the sections on:

• types of risk management information
• risk assessment approaches
• how to gain and maintain assurance

The diagram below shows how this collection of guidance is structured. The introduction, fundamentals and framework sections should be read by all readers. The rest of the collection can be read based on the readers experience and requirements.

Improving business outcomes should be the primary driver for cyber security risk management. We advocate meaningful cyber security risk management that illuminates the real cyber risks that are applicable to your organisation and how it operates, rather than the use of techniques which just seek to satisfy compliance requirements.

For these reasons, this collection of guidance is not prescriptive. No single technique in this guidance will be useful in every situation. It is therefore important that you take care to understand why you have chosen the cyber security risk management techniques, methods and approaches you use, and how they can help you and your organisation better understand the cyber security risks you face.