Security Risk Management
What is Security Risk Management?
The ongoing process of identifying, analyzing, evaluating, and treating risks to an organization's information security.
Terms that appear alongside security risk management
Each of these is named in at least one of the same controls as security risk management. The number is how many controls name both.
- information security 8 shared controls
- governance 5 shared controls
- risk management framework 5 shared controls
- risk management plan 3 shared controls
- iso 27005 3 shared controls
- information system 2 shared controls
- incident response 2 shared controls
- incident reporting 2 shared controls
Frameworks that govern security risk management
What the standards actually require on security risk management
Requirements naming security risk management across 6 standards, quoted from the control text.
Requirement 0211 (Part Four: Technology, section 13.2.1 Technology Lifecycle Management; applies to All entities; dated 01 July 2025;
protective-security-policy-framework-pspf-release-2026::0211 · 0211 Technology Asset Stocktake and Technology Security Risk Management Plan →The CISO should establish and facilitate the agency's security risk management process.
new-zealand-information-security-manual-nzism::3.2.10.C.03 · 3.2.10.C.03 CISO establishes security risk management process →Assessment and treatment are refreshed regularly and whenever things change, organised in two cycles. The strategic cycle responds to shifts in the organisation's overall context (its business assets, the threats and sources of risk it faces, the objectives it...
iso-27005-2022::5.2 · Information security risk management cycles →Security convergence brings individual PAP systems under security risk management principles and ties them into the wider security systems and the risk management of the whole enterprise as one managed process.
ansi-asis-pap-1-2012-physical-asset-protection::B.1.4 · B.1.4 Security convergence of physical and information security risk management →The CISO coordinates security risk management activities between cyber security and business teams.
ISM-0726 · Coordinating security risk management →The department defines the scope of its IT security risk management activities: the programs, services and business activities needing protection, the major IT assets (applications, systems, data centres, networks, data) and where they are, and the core techno...
canada-itsg-33-it-security-risk-management::A1-4.2.1 · 4.2.1 Define the scope of the IT security risk management activities →Questions people ask about security risk management
What is Security Risk Management?
Why is Security Risk Management important for compliance?
Which compliance frameworks address Security Risk Management?
Where can I learn more about Security Risk Management?
See how Security Risk Management applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.