Risk

• An integrated and consistent approach to identify, manage and report all cyber security risks across the enterprise including internal and external threats.
• Cyber risks consolidated into reports that are current and can be reviewed by internal stakeholders and the board.

• Ensuring the approach to managing cyber related risks is aligned with the broader enterprise risk management framework so risks can be managed using existing process and controls and broader business risks can be considered.
• IE: Risk appetite processes can be applied to determine cyber risk appetite.

A process to identify and manage catastrophic risks and emerging threats. The high-consequence nature of these events requires that:

• Extreme cyber risks are identified, monitored and reported to the board.
• Catastrophic risks are treated differently to other risks already being managed and the capability to respond to these risks is developed and maintained.

Extreme event risks usually require a significant and coordinated response across an organisation or with external parties.

• Cyber risks related to third parties is understood and managed effectively in the increasingly complex and interconnected operating environment.
• A mature cyber risk management culture that extends the focus to understanding the risks and vulnerabilities of critical suppliers and other third parties.