| Table of Contents | ||
|---|---|---|
|
...
Risk Management Domain Attributes
Property | Description | Example |
|---|---|---|
riskID | Unique identifier for the risk element | "RISK-CYBER-001" |
title | The name or title of the risk | "Critical Data Breach Risk" |
description | A detailed explanation of the risk | "The risk of unauthorized access to or exfiltration of sensitive customer data..." |
riskCategory | Classification of risk type | "technology" |
orgUnitTitle | Organization unit responsible for managing risk | "Information Security Department" |
orgUnitRoles | Specific roles managing this risk | ["Chief Information Security Officer", "Security Operations Manager"] |
riskSource | Origin of the risk | "external" |
riskOwner | Individual or role responsible for risk management | "Chief Information Security Officer" |
riskProbability | Likelihood of risk occurrence | {"level": "moderate", "numericValue": 0.35} |
riskImpact | Potential effect if risk is realized | {"level": "severe", "financialImpact": "$5-15 million"} |
riskSeverity | Combined measure of probability and impact | {"level": "high", "score": 16} |
riskTolerance | Acceptable level of this risk | {"toleranceLevel": "low", "thresholds": [{...}]} |
riskStatus | Current status in management lifecycle | "mitigated" |
mitigationStrategy | Approach to risk reduction | {"approachType": "reduce", "description": "Comprehensive cybersecurity program..."} |
residualRisk | Risk remaining after controls | {"level": "moderate", "acceptableLevel": true} |
controlEffectiveness | Effectiveness of current controls | {"level": "effective", "lastAssessment": "2025-03-15"} |
reviewFrequency | How often risk is reassessed | "quarterly" |
regulatoryImplications | Compliance aspects of this risk | [{"regulationType": "Data Protection", "regulationName": "GDPR"}] |
strategicImplications | Impact on strategic objectives | {"overallImpact": "mixed", "affectedObjectives": [{...}]} |
emergingFactors | Developing influences on this risk | [{"factorName": "AI-Enhanced Cyber Threats", "timeHorizon": "medium-term"}] |
relatedRisks | Relationships to other risks | [{"riskID": "RISK-TECH-005", "relationshipType": "contributor"}] |
keyRiskIndicators | Metrics used to monitor this risk | [{"indicatorName": "Security Incidents", "currentValue": "12"}] |
Risk Assessment Element Schema
Property | Description | Example |
|---|---|---|
assessmentID | Unique identifier for the risk assessment | "ASSESS-CYBER-2025-Q1" |
assessmentTitle | Name of the specific risk assessment | "Annual Cybersecurity Risk Assessment" |
description | Detailed explanation of the risk assessment | "Comprehensive assessment of cybersecurity risks including threats, vulnerabilities..." |
orgUnitTitle | Organization unit conducting assessment | "Information Security Department" |
assessmentMethod | Methodology used for assessment | "quantitative" |
assessmentScope | Boundaries of the assessment | {"inScope": ["Enterprise applications", "Customer data systems"]} |
assessmentContext | Business context for the assessment | "Supporting digital transformation initiative while ensuring data protection" |
assessmentDate | When assessment was conducted | {"startDate": "2025-01-15", "completionDate": "2025-02-28"} |
assessmentParticipants | People involved in assessment | [{"participantName": "Sarah Johnson", "participantRole": "CISO"}] |
riskCriteria | Criteria for evaluating risks | {"probabilityCriteria": [{...}], "impactCriteria": [{...}]} |
identifiedRisks | Risks discovered during assessment | [{"riskID": "RISK-CYBER-001", "riskTitle": "Critical Data Breach Risk"}] |
riskRankings | Prioritization of risks | [{"riskID": "RISK-CYBER-001", "priority": "high"}] |
assessmentFindings | Key outcomes and insights | [{"findingTitle": "Inadequate API security controls", "findingSeverity": "high"}] |
assessmentRecommendations | Suggested actions | [{"recommendationTitle": "Implement API gateway", "recommendationPriority": "high"}] |
assessmentOwner | Responsible party for assessment | "Chief Information Security Officer" |
nextAssessment | Timing for follow-up | {"plannedDate": "2026-01-15", "triggerEvents": ["Major system change"]} |
Risk Control Element Schema
Property | Description | Example |
|---|---|---|
controlID | Unique identifier for the risk control | "CTRL-CYBER-008" |
controlTitle | Name of the specific risk control | "Multi-factor Authentication" |
description | Detailed explanation of the risk control | "Requiring two or more verification factors before granting system access" |
orgUnitTitle | Organization unit responsible for this control | "IT Security Operations" |
controlType | Type of control measure | "preventive" |
controlCategory | Functional category of control | "technical" |
controlMethod | How control operates | "automated" |
controlObjective | What the control aims to achieve | "Prevent unauthorized access to systems and data through credential compromise" |
implementationStatus | Current implementation state | "operational" |
controlEffectiveness | How well control works | {"designEffectiveness": "effective", "operationalEffectiveness": "effective"} |
controlOwner | Responsible party for implementation | "Identity & Access Management Manager" |
controlCost | Cost of implementation and maintenance | {"implementationCost": 250000, "recurringCost": 80000, "costPeriod": "annually"} |
controlDocumentation | Reference documentation | [{"documentName": "MFA Standard", "documentType": "standard"}] |
controlTesting | How and when control is tested | {"testingMethod": "automated-monitoring", "testingFrequency": "monthly"} |
controlledRisks | Risks addressed by this control | [{"riskID": "RISK-CYBER-001", "controlWeight": 5}] |
relatedControls | Other linked control measures | [{"controlID": "CTRL-CYBER-012", "relationshipType": "complementary"}] |
controlStandards | Standards applied to this control | [{"standardName": "NIST 800-53", "standardReference": "IA-2(1)"}] |
exceptionsProcess | Process for handling control exceptions | "Requires CISO approval with business justification and compensating controls" |
Risk Response Element Schema
Property | Description | Example |
|---|---|---|
responseID | Unique identifier for the risk response | "RESP-CYBER-003" |
responseTitle | Name of the specific risk response | "Enhanced Data Protection Program" |
description | Detailed explanation of the risk response | "Comprehensive program to strengthen data security controls and practices" |
orgUnitTitle | Organization unit responsible for this response | "Information Security Department" |
responseStrategy | Approach to handling risk | "reduce" |
responseDescription | Detailed explanation of response approach | "Implementing technical controls, process improvements, and awareness training" |
targetedRisks | Risks being addressed | [{"riskID": "RISK-CYBER-001", "targetRiskLevel": "low"}] |
responseOwner | Responsible party | "Chief Information Security Officer" |
responsePriority | Priority level | "high" |
responseStatus | Current implementation status | "in-progress" |
responseTimeline | Implementation schedule | {"startDate": "2025-01-01", "targetEndDate": "2025-06-30"} |
responseSuccess | Criteria for successful response | {"successCriteria": [{"criterionName": "Security control implementation"}]} |
responseResources | Resources required | {"budget": 750000, "personnel": [{"role": "Security Engineer"}]} |
responseReporting | How progress is reported | {"reportingFrequency": "monthly", "reportingMethod": "Executive dashboard"} |
responseReview | Process for reviewing effectiveness | {"reviewMethod": "Independent assessment", "reviewFrequency": "quarterly"} |
costBenefitAnalysis | Analysis of response value | {"implementationCost": 750000, "recurringCosts": 250000, "returnOnInvestment": "325%"} |
implementedControls | Controls implemented as part of response | [{"controlID": "CTRL-CYBER-008", "implementationStatus": "implemented"}] |
lessonsLearned | Insights from response implementation | [{"lessonDescription": "Early stakeholder engagement critical to success"}] |
Risk Monitoring Element Schema
Property | Description | Example |
|---|---|---|
monitoringID | Unique identifier for the risk monitoring activity | "MON-CYBER-002" |
monitoringTitle | Name of the specific risk monitoring activity | "Cybersecurity Risk Monitoring Program" |
description | Detailed explanation of the risk monitoring activity | "Continuous monitoring of key risk indicators and control effectiveness" |
orgUnitTitle | Organization unit responsible for this monitoring | "Security Operations Center" |
monitoredRisks | Risks being monitored | [{"riskID": "RISK-CYBER-001", "monitoringPriority": "high"}] |
keyRiskIndicators | Indicators being tracked | [{"indicatorName": "Security Incidents", "currentValue": "12"}] |
monitoringFrequency | Frequency of monitoring activities | {"reviewCycle": "continuous", "justification": "Critical risk requiring real-time visibility"} |
monitoringMethods | Approaches used for monitoring | [{"methodName": "SIEM Analytics", "automationLevel": "fully-automated"}] |
earlyWarningSystem | System for early detection of risk changes | {"alertMechanisms": ["Automated alerts", "Dashboard indicators"]} |
monitoringResponsibilities | People responsible for monitoring | [{"role": "SOC Analyst", "responsibilities": ["Monitor alerts", "Initial triage"]}] |
reportingStructure | How monitoring results are reported | {"reportTypes": [{"reportName": "Weekly Security Status", "reportFrequency": "weekly"}]} |
technologySystems | Systems supporting monitoring | [{"systemName": "Security Information & Event Management", "systemFunction": "Log analysis"}] |
dataManagement | How monitoring data is managed | {"dataSources": ["Firewall logs", "IDS alerts", "Authentication logs"]} |
historicalPerformance | History of monitoring effectiveness | {"successRate": "93% of incidents detected by monitoring systems"} |
Schema Evolution Guidance
The Risk Management Domain schema is expected to evolve with emerging practices in risk management. Future extensions may include:
Enhanced predictive risk analytics
AI-assisted risk identification and assessment
Dynamic risk modeling capabilities
Operational resilience frameworks
Cyber and digital risk extensions
Integrated governance, risk, and compliance models
...
Systems supporting monitoring | [{"systemName": "Security Information & Event Management", "systemFunction": "Log analysis"}] | |
dataManagement | How monitoring data is managed | {"dataSources": ["Firewall logs", "IDS alerts", "Authentication logs"]} |
historicalPerformance | History of monitoring effectiveness | {"successRate": "93% of incidents detected by monitoring systems"} |