Has your organization established and implemented a standardized taxonomy of risk categories for consistent cybersecurity risk assessment and comparison?
Explanation
Using standardized risk categories enables organizations to effectively integrate risk data across different business units, compare risks using common terminology, and make informed decisions about risk prioritization. Without consistent categorization, organizations may struggle to aggregate risk information, potentially missing critical patterns or underestimating cumulative impacts of similar risks across different systems or departments.
Evidence could include a documented risk taxonomy or categorization framework that defines risk categories (e.g., operational, technical, compliance, third-party) with descriptions and examples of each. This framework should be referenced in risk assessment documentation to demonstrate consistent application across the organization.
Implementation Example
Use a consistent list of risk categories to support integrating, aggregating, and comparing cybersecurity risks
ID: GV.RM-06.029
Context
- Function
- GV: GOVERN
- Category
- GV.RM: Risk Management Strategy
- Sub-Category
- A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
Related questions
- Does your organization update cybersecurity risk management objectives as part of annual strategic planning and when significant organizational or environmental changes occur?
- Has your organization established measurable objectives for cybersecurity risk management?
- Have senior leaders established and agreed upon measurable cybersecurity objectives that are used to manage risk and evaluate performance?
- Has your organization formally defined and communicated risk appetite statements that clearly articulate acceptable levels of risk across different business areas?
- Has your organization translated high-level risk appetite statements into specific, measurable risk tolerance metrics that can be monitored and reported?
- Does your organization have a formal process to periodically review and update its risk appetite and objectives based on current risk exposure and residual risk levels?