Habit 03 of 18
Governance
A yearly risk review
Once a year you list what could go wrong and decide what to do about it.
Looking ahead once a year helps you spend effort where it matters. It is also how you show your measures are proportionate.
Switch it on in the map Counts towards 7 articles, controls and categories
§1 How to do it
How a small firm does it
- Once a year, list what could go wrong, such as ransomware, a lost laptop or a supplier outage.
- For each, note how likely it is and how bad it would be.
- Decide what to do about the biggest ones, who does it, and by when.
- Look back at last year's list. Did the measures you chose actually work?
Evidence that shows it
- The dated risk list with decisions and owners
- Notes on whether last year's actions were done and worked
Ireland: NCSC Ireland guidance on risk assessment applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 2 items
-
21(2)(a) Risk analysis and security policies · supports
policies on risk analysis and information system security
Risk analysis is named in this measure. A yearly risk review is its practical form.
Read Art 21(2)(a) on EUR-Lex -
21(2)(f) Checking whether measures work · supports
policies and procedures to assess the effectiveness of cybersecurity risk-management measures
A yearly review that also checks whether your measures worked is one way to assess their effectiveness.
Read Art 21(2)(f) on EUR-Lex
General Data Protection Regulation 1 item
-
32(1)(d) Regularly testing security measures · supports
a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
Article 32(1)(d) asks for regular checks on whether security measures work. A yearly review counts towards this when it also looks at how well your measures performed.
Read Art 32(1)(d) on EUR-Lex
ISO/IEC 27001:2022 1 item
-
Cl 6.1.2 Assessing information security risks · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The clause asks for a defined, repeatable way of assessing information security risks.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 3 items
-
GV.RM Risk management strategy · supports
GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
Reviewing risks the same way each year is a simple form of a standard method for rating and prioritising them.
Read GV.RM-06 on NIST -
ID.RA Risk assessment · subset
ID.RA-03: Internal and external threats to the organization are identified and recorded
ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
ID.RA-06: Risk responses are chosen, prioritized, planned, tracked, and communicated
Listing what could go wrong, how likely and how bad it would be, and deciding what to do about it, is what these outcomes describe.
Read ID.RA-03, ID.RA-04, ID.RA-06 on NIST -
ID.IM Improvement · supports
ID.IM-01: Improvements are identified from evaluations
Repeating the review each year is a simple way to find improvements.
Read ID.IM-01 on NIST
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.