text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: Directive (EU) 2016/1148

text: of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union.

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: [SOURCE: ISO 31000:2018] [SOURCE: ISO Directives, Part 1, Annex SL, Appendix 2] [SOURCE: ISO/IEC 27000:2018]

text: Note 1: an effect is a deviation from the Note 1 to entry: an effect is a deviation from expected. Certain organisations consider the expected — positive or negative. positive deviations in addition to negative Note 2 to entry: uncertainty is the state, even

text: March 2022

text: deviations in the risk context. partial, of deficiency of information related to understanding or knowledge of an event, its Note 2: risk is usually expressed in terms of consequence, or likelihood. risk sources, potential events, their consequences and their likelihood. Note 3 to entry: risk is often characterised by reference to potential events (as defined in Note 3: uncertainty is the state, even partial, ISO Guide 73) and consequences (as of deficiency of information related to defined in ISO Guide 73) or a combination of understanding or knowledge of an event, its these. consequence, or likelihood. Note 4 to entry: risk is often expressed in Note 4: objectives are not only but often are terms of a combination of the consequences related to business, organisation or projects. of an event (including changes in Another level of objectives is presented in circumstances) and the associated likelihood section 3.1. (as defined in ISO Guide 73) of occurrence.

text: March 2022

text: Abbreviation: SDO

text: March 2022

text: March 2022

text: March 2022

text: Common Criteria is abbreviated to CC. 4 A new edition is available as DIS.

text: March 2022

text: abbreviation: ISMS

text: March 2022

text: March 2022

text: This list is not exhaustive.

text: March 2022

text: This list is not exhaustive.

text: March 2022

text: This list is from ISO 31000: 2018, Clause 6.5.2

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: https://www.ssi.gouv.fr/uploads/2019/11/anssi-guide-ebios_risk_manager-en-v1.0.pdf - all subsequent images that relate to EBIOS RM are derived from this document, published by ANSSI

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: From the perspective of management system standards, the organisation is always related to the scope of the management system – and its risk management – and the distinction between ‘legal organisation’ and ‘IT-operation’ is incorrect.

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

identifier: Risk Management Standards

amnesord:
Market
Risk Management

nummer: risk-management-standards

title: Risk Management Standards

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: CONTACT

text: To contact the authors, please use mcs@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu

text: AUTHORS

text: Ralph Eckmaier, Walter Fumy, Stéfane Mouille, Jean-Pierre Quemard, Nineta Polemi, Rainer Rumpel

text: Sławomir Górniak – ENISA

text: LEGAL NOTICE

text: This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the

text: Regulation (EU) No 2019/881

text: ENISA reserves the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or in part must acknowledge ENISA as its source.

text: Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication.

text: Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: ENISA maintains its intellectual property rights in relation to this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2022

text: This publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated”.

text: ISBN 978-92-9204-569-2, DOI 10.2824/001991

text: RISK MANAGEMENT STANDARDS

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 5

text: 1.1 THE PURPOSE OF THIS DOCUMENT 5

text: 1.2 EU LEGAL REQUIREMENTS 5

text: 1.3 ENISA WORK ON RISK MANAGEMENT 8

text: 2. SCOPE AND DEFINITIONS 10

text: 2.1 SCOPE OF THE ANALYSIS 10

text: 2.2 NEEDS OF STAKEHOLDERS IN RELATION TO RISK MANAGEMENT 10

text: 2.3 DEFINITIONS 10

text: 2.3.1 Risk management 10 2.3.2 Standards and methodologies 12 2.3.3 Risk management vocabulary 13

text: 2.4 ROLE OF RISK MANAGEMENT STANDARDS IN CERTIFICATION SCHEMES 14

text: 2.4.1 Introduction 14 2.4.2 ICT Products certification 15 2.4.3 Management system certification 15

text: 3. BASELINE ANALYSIS 17

text: 3.1 OBJECTIVES OF RISK MANAGEMENT 17

text: 3.2 RISK MANAGEMENT PROCESSES 17

text: 3.3 USE OF STANDARDS IN RISK MANAGEMENT 20

text: 4. STANDARDS AND METHODOLOGIES 22

text: 4.1 RISK ASSESSMENT STANDARDS 22

text: 4.1.1 European SDOs (ESOs) and European Standards 22 4.1.2 International SDOs and Standards 23 4.1.3 National standardisation bodies and specialised agencies 23 4.1.4 Industrial bodies 24 4.1.5 The Risk Management Standards Inventory 24 4.1.6 Risk management methodologies and tools 25

text: 4.2 OTHER SYSTEMS AND TOOLS SUPPORTING RM 28

text: 4.3 PRACTICAL USE OF STANDARDS AND METHODOLOGIES 30

text: RISK MANAGEMENT STANDARDS March 2022 5. RESULTS OF THE ANALYSIS 34 6. RECOMMENDATIONS 38

text: 6.1 EU POLICY MAKERS 38

text: 6.2 EUROPEAN SDOS 39

text: 6.3 ENISA 39

text: ANNEX A: INVENTORY OF RISK MANAGEMENT RELATED STANDARDS41 ANNEX B: ANALYSIS OF EIDAS REGULATION 55 RISK MANAGEMENT STANDARDS

text: EXECUTIVE SUMMARY

text: The purpose of this document is to provide a coherent overview of published standards that address aspects of risk management and subsequently describe methodologies and tools that can be used to conform with or implement these standards.

text: The

text: Regulation (EU) 2019/881

text: (Cybersecurity Act) states that ‘ENISA shall facilitate the establishment and take-up of European and international standards for risk management and for the security of ICT products, ICT services and ICT processes’. (

text: Article 8.5

text: This analysis is intended to contribute to the achievement of this goal. It is based on a compiled, comprehensive inventory of standards in the area of cybersecurity risk management and methodologies related to standards. This publication provides guidance to EU Institutions, bodies and agencies on the availability of standards and methodologies relevant to the management of cybersecurity risk and outlines possible gaps in these domains, enabling the relevant EU institutions, bodies and agencies to initiate activities to close these gaps in order to further implement the cybersecurity policies stemming from the legislation.

text: Furthermore, this publication can also be used by organisations as a library of risk management standards and methodologies for their endeavour to implement risk management within their organisation or in their developments of cybersecurity certification schemes.

text: Standards are developed and defined through a process of sharing knowledge and building consensus among technical experts nominated by interested parties and other stakeholders. When it comes to developing and establishing standards, a large variety of players exist. Naturally, there is competition between these players but they also cooperate in many instances, in particular when there is a common interest.

text: Standards are voluntary which means that there is no automatic legal obligation to apply them. However, laws and regulations may refer to standards and even make compliance with them compulsory. This document aims also at providing a brief introduction to the main players when it comes to standards in the area of risk management, introducing the main characteristics of the different document types published by these players, and introducing the inventory of Risk Management Standards presented in the Annex A.

text: To help this targeted audience in understanding the risk management process and its associated standards, this document is structured in chapters that cover the relevant areas.

text: Based on the analysis provided in section 5 and making a distinction between risk management standards and risk management methodologies, we propose in section 6 a series of recommendations on the use of risk management standards for various groups of stakeholders – EU decision makers, European SDOs, and ENISA itself.

text: RISK MANAGEMENT STANDARDS

text: 1. INTRODUCTION

text: Risk Management is all about 1.1 THE PURPOSE OF THIS DOCUMENT

text: The purpose of this document is to provide a coherent overview of published standards that identifying and address aspects of risk management and subsequently list methodologies and tools that can protecting the be used to conform with or implement these standards.

text: valuable assets of an organisation.

text: This publication will provide guidance to EU institutions, bodies and agencies on the

text: Risk management

text: availability of standards and methodologies relevant to risk management and outline possible gaps in this domain, enabling the relevant EU institutions, bodies and agencies to initiate procedures are activities to close these gaps. fundamental

text: processes to

text: Furthermore, this publication can also be used by organisations as a library of risk

text: prepare

text: management standards and methodologies for their endeavour to implement risk

text: organisations for a

text: management within their organisations or develop cybersecurity certification schemes for ICT products, services and processes. future

text: cybersecurity

text: The list of applicable risk management standards and the associated gap analysis provided in attack, to evaluate this document will be some key inputs in providing content and support in a relevant

text: products and

text: cybersecurity policy area related to risk management as described in the Cybersecurity Act,

text: services for their

text: Article 8

text: , point 5:

text: resistance to

text: “ENISA shall facilitate the establishment and take-up of European and international standards potential attacks for risk management and for the security of ICT products, ICT services and ICT processes”. before placing

text: them on the

text: This document also targets critical sectors as defined in the Annex II of the NIS Directive :

text: market, and to

text: Energy, Transport, Banking, Financial market infrastructures, the Health sector, Drinking

text: prevent supply

text: water supply and distribution, and Digital Infrastructure.

text: chain fraud. 1.2 EU LEGAL REQUIREMENTS

text: European institutions, bodies and agencies have released several publications – including regulations and directives – concerning the concept of risk management.

text: These publications are not limited to the classical domain of ICT but also cover transversal or sectorial domains (e.g. maritime, automotive, space, energy, healthcare) with their underlying information security and cybersecurity.

text: The concept of risk related to the security of ICT infrastructure was initially defined in the first cyber security legislation: The NIS directive - The Network Information Security Directive - Directive 2016/1148.

text: The directive has placed several legal obligations on ICT security and has also provided a clear definition of how risk is defined in in the context of this directive.

text: Article 4

text: (definitions) point (9): ‘risk’ means any reasonably identifiable circumstance or

text: event having a potential adverse effect on the security of network and information

text: systems.

text: RISK MANAGEMENT STANDARDS

text: The NIS directive can be considered as the origin of any EU requirement regarding risk management within the ICT domain.

text: The table here below provides the references on risk management included in the NIS directive.

text: Table 1: References on risk management in the NIS directive

text: Article Point Text

text: Recital Point 4 ‘Building upon the significant progress within the European Forum of Member States in fostering discussions and exchanges on good policy practices, including the development of principles for European cyber-crisis cooperation, a Cooperation Group, composed of representatives of Member States, the Commission, and the European Union Agency for Network and Information Security (‘ENISA’), should be established to support and facilitate strategic cooperation between the Member States regarding the security of network and information systems. For that group to be effective and inclusive, it is essential that all Member States have minimum capabilities and a strategy ensuring a high level of security of network and information systems in their territory. In addition, security and notification requirements should apply to

text: operators of essential services and to digital service

text: providers to promote a culture of risk management and ensure that the most serious incidents are reported.’

text: Recital Point 44 ‘Responsibilities in ensuring the security of network and information systems lie, to a great extent, with operators of essential services and digital service providers. A culture of risk

text: management, involving risk assessment and the implementation of security measures appropriate to the risks faced, should be promoted and developed through appropriate regulatory requirements and voluntary industry

text: practices. Establishing a trustworthy level playing field is also essential to the effective functioning of the Cooperation Group and the CSIRTs network, to ensure effective cooperation from all Member States.’

text: Recital Point 46 ‘Risk-management measures include measures to identify

text: any risks of incidents, to prevent, detect and handle

text: incidents and to mitigate their impact. The security of network and information systems comprises the security of stored, transmitted and processed data.’

text: Article 7

text: 7,f ‘Each Member State shall adopt a national strategy on the security of network and information systems defining the strategic objectives and appropriate policy and regulatory measures with a view to achieving and maintaining a high level of security of network and information systems and covering at least the sectors referred to in Annex II and the services referred to in Annex III. The national strategy on the security of network and information systems shall address, in particular, the following issues:

text: RISK MANAGEMENT STANDARDS

text: 7, f) a risk assessment plan to identify risks.’

text: Regarding the security of ICT products, ICT services and ICT processes, the crucial EU legal requirements are presented in the Cybersecurity Act Regulation -

text: Regulation (EU) 2019/881

text: (CSA regulation).

text: Table 2: References on risk management in the CSA

text: CSA items Cybersecurity Act Regulation -

text: Regulation (EU) 2019/881

text: Recital point (11) Modern ICT products and systems often integrate and rely on one or

text: Risk management

text: more third-party technologies and components such as software modules, libraries, or

text: as a tool for

text: application programming interfaces. This reliance, which is referred to as a ‘dependency’, cybersecurity could pose additional cybersecurity risks as vulnerabilities found in third-party components vulnerability could also affect the security of the ICT products, ICT services and ICT processes. In

text: management and many cases, identifying and documenting such dependencies enables end users of ICT products, ICT services and ICT processes to improve their cybersecurity risk remediation management activities by improving, for example, users’ cybersecurity vulnerability

text: management and remediation procedures.

text: Recital (49) Efficient cybersecurity policies should be based on well-developed risk

text: Importance of

text: assessment methods, in both the public and private sectors. Risk assessment methods

text: European and

text: are used at different levels, with no common practice regarding how to apply them international risk efficiently. Promoting and developing best practices for risk assessment and for management interoperable risk management solutions in public-sector and private-sector organisations standards and will increase the level of cybersecurity in the Union. To that end, ENISA should support

text: cooperation between stakeholders at Union level and facilitate their efforts relating methods to the establishment and take-up of European and international standards for risk management and for the measurable security of electronic products, systems, networks and services which, together with software, comprise the network and information systems.

text: Creating the link

text: Article 5

text: : Development and implementation of Union policy and law between the ICT

text: ENISA shall contribute to the development and implementation of Union policy and law, by:

text: risk management

text: (2) assisting Member States to implement the Union policy and law regarding cybersecurity

text: from the NIS

text: consistently, in particular in relation to

text: Directive (EU) 2016/1148

text: , including by means

text: directive and the of issuing opinions, guidelines, providing advice and best practices on topics such CSA regulation

text: as risk management, incident reporting and information sharing, as well as by facilitating the exchange of best practices between competent authorities in that regard.

text: Promoting and

text: Article 8

text: : Market, cybersecurity certification, and standardisation facilitate the Point 5. ENISA shall facilitate the establishment and take-up of European and

text: establishment of international standards for risk management and for the security of ICT products, ICT services and ICT processes. European and international standards for ICT risk management

text: The next table provides a non-exhaustive list of existing EU legislative acts (transversal or sectorial) where the concept of risk or risk management for information security or cybersecurity aspects is included:

text: Table 3: non-exhaustive list of existing EU legislation texts containing risk management

text: Cybersecurity Act Regulation-

text: Regulation (EU) 2019/881

text: CSA

text: NIS Network Information Security Directive - Directive 2016/1148

text: eIDAS Electronic Identification and Trust Services for Electronic Transactions -

text: RISK MANAGEMENT STANDARDS

text: Regulation (EU) No 910/2014

text: General Data Protection Regulation -

text: Regulation (EU) 2016/679

text: GDPR PSD2 Directive on payment services in the internal market –

text: Directive (EU) 2015/2366

text: AML Anti-Money Laundering Directive -

text: Directive (EU) 2015/849

text: RED Radio Equipment Directive- Directive

text: (RED) In Annex B an example of how ICT risk and risk management are addressed in the existing eIDAS regulation (Electronic Identification and Trust Services for Electronic Transactions –

text: Regulation (EU) No 910/2014

text: ) is presented. At the time of publishing this document, the European Commission is preparing new or amended legislation containing the concept of risk management (see table below).

text: Table 4: non-exhaustive list of proposed EU legislative acts containing risk management

text: NIS V2 Directive on security of network and information systems V2

text: eIDAS V2 EU regulation on electronic identification and trust services for electronic transactions in the European Single Market

text: Artificial Intelligence Act Proposal for a Regulation of the European Parliament and of the Council laying down harmonized rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts COM/2021/206 final

text: ePrivacy regulation Proposal for a Regulation of the European Parliament and of the Council concerning respect for private life and the protection of personal data in electronic communications and repealing Directive

text: (Regulation on Privacy and Electronic Communications) COM/2017/010 final - 2017/03 (COD)

text: Digital Service Act Proposal for a Regulation of the European Parliament and of the Council on a Single Market For Digital Services (Digital Services Act) and amending Directive

text: COM/2020/825 final

text: 1.3 ENISA WORK ON RISK MANAGEMENT

text: Since its creation ENISA has worked on the risk management issue and has produced several documents on this topic.

text: Table 5: Non-exhaustive list of relevant ENISA publications

text: Editor Publication name

text: Methodology for a Sectoral Cybersecurity Assessment ENISA ENISA Threat Landscape for Supply Chain Attacks ENISA Guidelines - Cyber Risk Management for Ports

text: RISK MANAGEMENT STANDARDS

text: ENISA National-level Risk Assessments: An Analysis Report ENISA Consumerisation of IT: Final report on Risk Mitigation Strategies and Good Practices ENISA Inventory of Risk Management / Risk Assessment Methods and Tools ENISA Guidelines for trust service providers - Part 2: Risk assessment ENISA Cloud Computing Risk Assessment ENISA Methodology for sectoral cybersecurity assessments Apart from the relevant work conducted by ENISA in this area, the European Commission has funded a number of research projects related to Risk Management. The references can be found at https://cordis.europa.eu/ .

text: RISK MANAGEMENT STANDARDS

text: 2. SCOPE AND DEFINITIONS

text: 2.1 SCOPE OF THE ANALYSIS

text: The

text: Regulation (EU) 2019/881

text: (Cybersecurity Act) states that ‘ENISA shall facilitate the

text: establishment and take-up of European and international standards for risk management

text: and for the security of ICT products, ICT services and ICT processes’. (

text: Article 8

text: no. 5)

text: This analysis is intended to contribute to the achievement of this goal. It is based on a compiled and comprehensive inventory of standards (Annex A) in the area of cybersecurity risk management and methodologies related to standards. Special attention is given to the analysis of gaps and overlaps of the available standards.

text: The analysis aims to identify practical ways to apply these standards by different stakeholders, compiling guidelines and good practices.

text: 2.2 NEEDS OF STAKEHOLDERS IN RELATION TO RISK MANAGEMENT

text: More and more organisations understand that cybersecurity and information security risks have to be managed because corresponding threats can have substantial consequences to the organisation or even threaten its existence.

text: As stated in the introduction, this publication shall provide guidance to EU institutions, bodies and agencies, as well as to various organisations, to be used as a library of risk management standards and methodologies for their endeavour to implement risk management processes.

text: Many of these stakeholders are looking for advice on which standards or methodologies are suitable for their organisation. Small companies are often overwhelmed by what is offered in the market and find choosing suitable methods difficult. This paper also presents methodologies for small companies (e.g. OCTAVE-S). When implemented, risk management approaches are influenced by the sector in which the organisation does its business. There are sector-specific risk management standards and methodologies that take into account the related specifics.

text: 2.3 DEFINITIONS 2.3.1 Risk management

text: Risk

text: There are two slightly different definitions within documents published by the ISO and the IEC that are relevant for risk management. These are listed for comparison in the following table.

text: Table 6: Comparison of risk definitions in ISO standards and directives

text: Effect of uncertainty on objectives Effect on uncertainty

text: RISK MANAGEMENT STANDARDS

text: As stated in the comparison table above, there are slightly diverging definitions of risk within the ISO domain. These definitions diverge depending on whether a risk is connected to a defined objective (ISO 31000) or not. In the context of a management system standard, such as ISO/IEC 27001, risks can arise regardless of whether objectives have been set in advance.

text: ISO/IEC 27000:2018 contains the definition of ISO 31000:2018 because the ISO 31000 definition is referenced in ISO/IEC 27005.

text: For ISO/IEC 27001, the definition of Annex SL is relevant, as ISO/IEC 27001 has to follow the text of the ISO Directives.

text: For example, the sector-specific standard ISO/SAE 21434:2021 follows the definition on the righthand side of the table, that risk is the ‘effect on uncertainty on road vehicle cybersecurity’.

text: In

text: Directive (EU) 2016/1148

text: (‘NIS Directive’) there is a different definition of risk.

text: Article 4

text: states that risk is ‘any reasonably identifiable circumstance or event having a potential adverse effect on the security of network and information systems’. Compared with the definitions given by ISO standards and directives the focus here is on the threat component in relation to the source of risk not to the effect. Cf. ISO/IEC 27005 DIS (2021) Clause 8,2,3.

text: Risk management

text: Coordinated activities to direct and control an organisation with regard to risk.

text: [SOURCE: ISO 31000:2018]

text: Note: the essential elements of risk management are risk assessment and risk treatment or mitigation.

text: Risk assessment

text: Overall process of risk identification, risk analysis and risk evaluation.

text: [SOURCE: ISO Guide 73:2009]

text: Risk treatment

text: Process to modify risk.

text: [SOURCE: ISO Guide 73:2009]

text: RISK MANAGEMENT STANDARDS

text: Note: risk treatment can be carried out using different options, e.g. avoiding the risk or changing the likelihood (of events or consequences).

text: 2.3.2 Standards and methodologies

text: What is a standard? A standard is a document generally established by consensus and approved by a recognised body that provides rules or guidance on the design, use or performance of materials, products, technologies, processes, services, systems or persons. Standards can be developed by national, regional and international standards developing organisations (e.g. ISO, IEC, CEN, ETSI, DIN).They can also be developed by consortia of businesses to address a specific marketplace need or by government departments to support regulations. Not every standard is called a ‘standard’. For example, another common name used is Technical Specification. In this case, as a rule, a qualified majority may also be sufficient for the adoption of the document. A more extensive description of standard developing organisations and their deliverables is provided in chapter number 4.1. of this document (section 4.1.1.) What is a methodology? A methodology is a set of principles and methods (at least one) adhering to good practices used to perform a particular activity. It’s a coherent and logical scheme that guides the choices users of the methodology make. What is the relation between standards and methodologies? Some methodologies are (published as) standards and some standards include methodologies.

text: Option 1: Methodology is used to achieve conformance to a standard (with reference in part or in whole to a certain standard and its requirements). Option 2: Methodology is given as a standard and can be used to achieve conformance to a standard and its requirements. Option 3: Methodology is a set of good practices but not related to any standard and not used to achieve conformance.

text: RISK MANAGEMENT STANDARDS

text: A methodology clarifies how certain issues should be handled. The methodology is often defined through test-specifications related to a standard. If a methodology is given as a standard the same is true. Moreover there are also many standards which focus on what to do and not how to do (mainly requirements standards).

text: Table 7: Examples of methodologies, which are published as standards

text: ISO 13053-1:2011 Quantitative methods in process improvement — Six Sigma — Part 1: DMAIC methodology

text: ISO/IEC Information technology — Security techniques — Methodology for IT 18045:2008 security evaluation

text: ETSI TS 102 165- CYBER — Methods and protocols — Part 1: Method and pro forma 1:2017 for Threat, Vulnerability, Risk Analysis (TVRA)

text: 2.3.3 Risk management vocabulary

text: The vocabulary of risk management is often different between standards and methodologies. It can be observed that the definitions of terms used in well-known ISO standards and guides (Table 8) are quite similar while there are clear differences in other standards (e.g. in Table 9). ISO definitions are compact while others are more extensive. The definition of risk acceptance is missing in NIST and BSI Germany.

text: Table 8: Examples of risk management terms in ISO standards and guides

text: risk management coordinated activities --- coordinated activities to direct and control to direct and control an organisation with an organisation with regard to risk regard to risk risk assessment overall process of overall process of overall process of risk identification, risk risk identification, risk identification, analysis and risk risk analysis and risk analysis and risk evaluation risk evaluation evaluation risk acceptance retaining the risk by informed decision to informed decision to informed decision take a particular risk take a particular risk

text: Table 9: Examples of risk management terms in some other standards

text: risk process that requires consists of the following steps: risk management organisations to: assessment; risk evaluation; (i) frame risk; determination of safeguards for treating risks; comparison between the costs of (ii) assess risk; every safeguard and the damage to be (iii) respond to risk; and expected and decision in favour of or (iv) monitor risk. against the implementation of the safeguard; examination of the residual risks: definition of handling options; comparison with opportunities; monitoring of the risks and adjustment of the safeguards or handling options during live operation.

text: RISK MANAGEMENT STANDARDS

text: risk assessment The purpose is to identify: is the determination of the frequency of (i) threats to organisations or occurrence of the threat and extent of threats directed through damage. organisations against other organisations or the nation; (ii) vulnerabilities internal and external to organisations; (iii) the harm to organisations that may occur given the potential for threats exploiting vulnerabilities; and (iv) the likelihood that harm will occur. risk acceptance --- ---

text: 2.4 ROLE OF RISK MANAGEMENT STANDARDS IN CERTIFICATION SCHEMES 2.4.1 Introduction

text: There are many relations between risk management processes and standards.

text: Risk management consists of the following steps:

text: 1. Identification of threats In this phase the various threats or threat models are identified according to different methods. For example, the assets to be protected are listed according to the risk management policy and the relevant potential threats are listed. Threat identification can also be done according to other methods such as the identification of vulnerabilities or threat models. Standards can provide a checklist to help with identifying different assets, threats or vulnerabilities consistent with particular regulations (for example NIS or GDPR).

text: 2. Evaluation of threats The different threats are evaluated according to different sources. For example, cyber threat intelligence (CTI) can be used or standards on the ontology and terminology of threats. Standards can provide guidance on threat selection according to the security profile selected.

text: 3. Evaluation of risk The risk evaluation process is key to defining how to use the scale of threats, impacts, likelihood and occurrence parameters in order to prioritise different threats. Here, standards are of strong interest.

text: 4. Mitigation of risk

text: Risk mitigation is the answer you will put in place in order to handle the risks identified. Risk management standards like ISO/IEC 27005 or EN 303 645 are helpful examples. 5. Evaluation and assessment of risk controls

text: In this last step we will evaluate implemented security controls, check their efficiency and assess the mitigation of security risk.

text: RISK MANAGEMENT STANDARDS 2.4.2 ICT Products certification

text: An ICT product means an element or a group of elements of a network or information system. Definition from EU Cybersecurity Act

text: A well-known framework for evaluating and certifying ICT products, which also became an international standard is Common Criteria for Information Technology Security Evaluation . EN ISO/IEC 15408 establishes the concepts, principles and techniques for IT security evaluation.

text: The standard consists of three parts: the EN ISO/IEC 15408-1:2020 that introduces the general concepts and model, the EN ISO/IEC 15408-2:2020 that includes the security functional components and the EN ISO/IEC 15408-3:2020 that describes the security assurance components.

text: ISO/IEC 18045:2020 is a companion standard for the ISO/IEC 15408 family and provides a methodology to help an IT security evaluator to conduct a CC evaluation by defining the minimal actions to be performed.

text: The IT Security of ICT products is concerned with the protection of assets. Assets according to EN ISO/IEC 15408-1:2020 include the integrity of the contents of a database, the availability of an electronic workflow, the authenticity of requests received by a webserver. The information of many assets is stored, processed and transmitted by ICT products to meet the requirements specified by the owner of the information.

text: Due to the CC security concept the information owner who wishes to minimise the risk to an asset is exposed by imposing countermeasures. The selection of countermeasures depends on the threats identified for the asset, consideration of the likelihood of the threat being realised and the impact on the asset when a threat is realised. CC distinguishes between IT countermeasures and non-IT countermeasures.

text: An example of a sector-specific standard for risk management of assets is EN ISO 14971:2019 Medical devices — Application of risk management to medical devices.

text: To become a CC evaluation body it is necessary to conform to the requirements written in EN ISO/IEC 17025:2017. ISO/IEC 17000-series (17000:2020, 17020:2012, 17021:2015, 17024:2012, 17025:2017 and 17067:2013) is an international set of standards that mainly provides from general concepts and principles for Conformity Assessment (CA) to guidelines, good practices and requirements for bodies serving as certification authorities.

text: 2.4.3 Management system certification

text: An ICT service means a service consisting fully or mainly in the transmission, storing, retrieving or processing of information by means of network and information systems. An ICT process means a set of activities performed to design, develop, deliver or maintain an ICT product or ICT service. Definition from EU Cybersecurity Act

text: There are several international standards defining requirements for the certification of management systems. The list includes:

text: • ISO 28000:2009: Specification for security management systems for the supply chain;

text: RISK MANAGEMENT STANDARDS

text: • ISO 45001:2018 Occupational health and safety management systems; requirements with guidance for use; • EN ISO 50001:2018 which specifies requirements for establishing, implementing, maintaining and improving an energy management system (EnMS); • ISO/IEC 20000-1:2018 Information technology — Service management — Part 1: Service management system requirements; • EN ISO/IEC 27001: 2017 Information technology - Security techniques - Information security management systems – Requirements.

text: If an organisation intends to certify an ICT service or an ICT process or a group of these (called ‘entity’ as of now), then it is suitable to define this entity as the scope of its management system. On this basis, ICT services or ICT processes can be certified by assessing their conformity to the requirements specified in ISO/IEC 20000 or EN ISO/IEC 27001.

text: When an organisation intends to achieve conformance with the requirements of a management system standard such as EN ISO/IEC 27001:2017, the requirements addressing risk management can be found in these clauses:

text: • 6.1 Actions to address risks and opportunities • 8.2 Information security risk assessment • 8.3 Information security risk mitigation.

text: Whereas sub-clause 6.1.1 addresses high-level risks such as management system risks and strategic risks, the sub-clauses 6.1.2 and 6.1.3 specify requirements regarding the management of risk for the security of operational information.

text: ISO/IEC 27005 (Information security risk management) offers closely aligned support for implementing the requirements for risk management in entities within the scope of the ISMS. Furthermore, among others, the following standards are helpful:

text: • ISO 31000 – Risk management guidelines (general perspective) • BSI 7799-3 – Guidelines for information security risk management • NIST SP 800-39 – Managing Information Security Risk • BSI Germany Standard 200-3 - Risk analysis based on IT-Grundschutz

text: Examples of sector-specific standards for risk management in the context of a management system are:

text: • BS 31111:2018 Cyber risk and resilience: Guidance for the governing body and executive management services (also useful for ICT product certification); • ISO/FDIS 23314-2 Ships and marine technology — Ballast water management systems (BWMS) — Part 2: Risk assessment and risk reduction of BWMS using electrolytic methods; • ASTM F3449-2 Standard Guide for Inclusion of Cyber Risks into Maritime Safety Management Systems and services in Accordance with IMO Resolution MSC.428(98)- Cyber Risks and Challenges.

text: Conformance to ISO/IEC 27001 can be confirmed by certification bodies, which are accredited in conformity with the families of standards ISO/IEC 17021 and ISO/IEC 27006.

text: RISK MANAGEMENT STANDARDS

text: 3. BASELINE ANALYSIS

text: 3.1 OBJECTIVES OF RISK MANAGEMENT

text: The main objective of risk management within an organisation is to determine possible uncertainties or threats, to protect against resulting consequences and to permit the achievement of business objectives.

text: The objectives of risk management can be derived from the overall objectives of the organisation, its business and legal obligations.

text: These objectives must be clearly defined at the beginning of the risk management process. These objectives must also be measurable in order to be able to verify their achievements. The use of KPIs (key performance indicators) is recommended. The objectives must be related to the assets of the entity that are to be protected against risks and their consequences.

text: These objectives are determined during the establishment of the context of a risk management process (see Clause 3.3. Risk management process).

text: 3.2 RISK MANAGEMENT PROCESSES

text: The risk management process is the individual way in which an organisation addresses the concept of risk and the relevant types of risk within itself. The risk management process is a fundamental part of any organisation and has to be integrated into all relevant (business) processes and activities, and if necessary – based on the type and nature of the business of the organisation – on several layers.

text: If an organisation wants to achieve conformance with a management system standard (type A) based on the ISO Directives, Annex SL, Appendix 2, the risk management process is one of the fundamental and essential processes within the organisation within the scope of the management system. Nevertheless, ISO 31000:2018 does not give guidance on a risk management system but describes a risk management framework. EN ISO/IEC 27001:2018 is a management system standard based on the Harmonised Framework and requires a risk management process in clauses 6.1, 8.2 and 8.3.

text: Risk management may address individual types of risks, such as enterprise risk, market risk, credit risk, operational risk, project risk, development risk, supply chain risk, infrastructure risk, component risks or several of the risk types listed or all of them. This list is not exhaustive and depending on the type of business an organisation has, additional types of risks may exist and be of relevance.

text: In the context of this document which addresses cybersecurity and information security, these types of risks have to be assessed in conjunction with the three properties of information security – confidentiality, integrity and availability. For example, what consequences may arise for market risk from a loss of integrity, or what consequences may arise for supply chain risk from a loss of confidentiality, and so on?.

text: In the context of this document, the elements of the risk management process contained in ISO 31000:2018 will be applied to describe a possible implementation of a risk management process within an organisation. Independent of the organisation’s actual implementation of its risk management process, all activities outlined in ISO 31000:2018 will be more or less present, independently of whether such a risk management process is integrated into an organisation

text: RISK MANAGEMENT STANDARDS

text: seeking conformance with EN ISO/IEC 27001:2018 or any other ISO management system standard.

text: Scope, Context, Criteria

text: When establishing risk management within an organisation, the fundamental decisions regarding the risk management process itself are made during the determination of the scope, the context and the criteria.

text: Based on the scope of the risk management, different sub-processes using several risk assessment methodologies may be applied within an organisation.

text: The scope may be derived from:

text: • the relevant internal and external interested parties; • its level of application (strategic, operational, programme, project, supply-chain, product development, software development); • its inclusion into a formal management system; • its relationships to other organisations, entities, activities, projects, processes; • its objectives; • the available resources (personnel, software tools, etc.) .

text: RISK MANAGEMENT STANDARDS

text: Risk management addressing information security or cybersecurity may also involve different application domains:

text: • critical infrastructure (health, electricity, communication etc.); • sensitive data; • supply chain.

text: When it comes to the context, this may depend on:

text: • the interested parties (external and internal), • the objectives and activities of the organisation, • the purpose of the risk management, • the integration into an existing risk management framework or management system.

text: During the determination of the criteria in this early stage of establishing risk management, the organisation, based on the previous results of determining the scope and the context, also determines:

text: • the type of risk it is managing, • the risk assessment methodology to apply, • the criteria for evaluation the risks, • the criteria for accepting risk.

text: Thereafter, the risk criteria as determined have significant consequences on the subsequent activities of a risk management process, such as risk assessment and risk mitigation.

text: Risk assessment

text: Risk assessment is most commonly composed of threats identification, threats evaluation, risk analysis and risk evaluation (see Figure 1).

text: Depending on the decisions taken during the scope, context and criteria activities, different methodologies may be implemented for different types of risks and for different layers.

text: Threats identification is the activity of finding and describing threats systematically and should consider the following factors:

text: • sources of risk, • causes and events, • threats and vulnerabilities, • emerging risks and threats, • nature and value of assets, • consequences and impact on processes and assets .

text: During risk analysis, the factors listed above are used to comprehend the nature and the level of a threat or risk based on factors such as:

text: • the likelihood of an event, threat or risk; • the magnitude of consequences triggered by an event, threat or risk; • the complexity including possible links, dependencies and cascading effects;

text: RISK MANAGEMENT STANDARDS

text: • the effectiveness of existing controls; • time-related factors such as volatility or the period under consideration.

text: The results of the risk analysis provide the input to the risk evaluation in which the results from the risk analysis are compared to the previously established risk criteria including the criteria for the acceptance of risk. These results may be calculated based on criteria for consequence and likelihood, or by using other means such a heat maps or tables.

text: Risk treatment

text: Risk treatment (as defined in, among others, ISO 31000) is the activity of selecting an adequate option for treating risks that are above a previously defined acceptable risk level.

text: These options are:

text: • avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk; • taking or increasing the risk in order to pursue an opportunity; • mitigating the source of the risk; • changing the likelihood; • changing the impacts and consequences; • sharing the risk (e.g. through contracts, buying insurance); • retaining the risk through an informed decision.

text: The selected risk treatment option must be approved by the risk owner and documented. Based on this decision, a risk treatment plan shall be formulated and approved by the risk owner, and implemented according to the project plan included in the risk treatment plan.

text: A risk treatment plan and the newly introduced controls may result in new risks or threats that need to be addressed separately.

text: The other elements of Figure 1 (Communication and Consultation, Recording and Reporting, Monitoring and Review) are, in the context of this document, considered not to be part of the risk management process but rather established parts of a management system based on an ISO management system standard and are therefore not covered in this document.

text: Note: risk treatment that deals with negative consequences is sometimes referred to as risk mitigation’.

text: 3.3 USE OF STANDARDS IN RISK MANAGEMENT

text: When integrating the concept of risk management into its organisation, an entity is looking for appropriate approaches that are adequate for their business and the scope and the objective of their risk management efforts.

text: Organisations may decide that they need an overall enterprise risk management to address all types of risks (such as operational risk, market risks, supply chain risks, project risks or strategic risks) or just a specific type of risk (see examples of risks previously stated).

text: For these different scopes and objects, and specific to the organisations’ main business activities, different risk assessment and treatment models may be used.

text: RISK MANAGEMENT STANDARDS

text: Thus, organisations may wish to learn from other organisations in their field of business and try to establish approaches to best practices that seem to fit them and others in their discipline or field of activities.

text: Based on this goal, it is common to find that risk assessment or risk treatment models for specific sectors or businesses are developed by sector associations or interest groups. Many times, these sector or discipline-specific models evolve into international standards by forwarding their results to the technical committee of an international or European standardisation organisation.

text: Being considered as a standard by an international community of experts and thereby gaining wider attention and improvement, enables additional organisations to find adequate solutions to fulfil their needs regarding the assessment and treatment of risks.

text: Such standards can provide generic guidance on terminology, principles, process models and treatment options (e.g. ISO 31000) as well as detailed descriptions of risk assessment models (e.g. ISO/IEC 31010, ISO/IEC 27005).

text: Applying these different standards at different levels of an organisation can enhance the reproducibility of results, enable the comparison of different organisations and support the evaluation of the processes involved and their results within an organisation. Applying the same standard within a discipline or sector also provides the ability to benchmark one organisation against another or against an average for a sector or an entire discipline.

text: Standards, in principle, also enable organisations to estimate and compare the suitability, the effectiveness, the efficiency and the coverage of individual models and methods for a specific sector or discipline of a business and thereby support organisations in choosing an adequate standard for integration into their organisation.

text: Not only standards that especially address and describe risk assessment and risk treatment methods are important for the integration of the concept of risk management into an organisation. Widely accepted management system standards, such as ISO 9001 (Quality management system), ISO 14001 (Environmental management system) and ISO/IEC 27001 (Information security management system), have the concept of risk awareness integrated in their requirements and thus mandate the concept of risk management should an organisation claim conformance to these management system standards.

text: RISK MANAGEMENT STANDARDS

text: 4. STANDARDS AND METHODOLOGIES

text: 4.1 RISK ASSESSMENT STANDARDS

text: Standards are developed and defined through a process of sharing knowledge and building consensus among technical experts nominated by interested parties and other stakeholders. When it comes to developing and establishing standards, there is a large variety of players. Naturally, there is competition between these players but they also cooperate in many instances, in particular when there is a common interest.

text: Standards are voluntary which means that there is no automatic legal obligation to apply them. However, laws and regulations may refer to standards and even make compliance with them compulsory.

text: The following sections:

text: • provide a brief introduction to the main players when it comes to standards in the area of risk management; • introduce the main characteristics of the different document types published by these players; • introduce the inventory of risk management standards as presented in Annex A of this document.

text: 4.1.1 European SDOs (ESOs) and European Standards

text: European Standards (ENs) are documents that have been ratified by one of the three European Standardisation Organisations (ESOs), CEN, CENELEC or ETSI, and are recognised as competent in the area of voluntary technical standardisation in accordance with EU Regulation 1025/2012.

text: • CEN, the European Committee for Standardization, reflects the economic and social interests of 34 CEN Member countries channelled through their national standardisation organisations and provides a platform for the development of European standards and other technical documents in relation to a wide range of fields and sectors including air and space, consumer products, defence and security, energy, health and safety, ICT, machinery, services, smart living, and transport. • CENELEC is the European Committee for Electrotechnical Standardisation and is responsible for standardisation in the electro-technical engineering field. • ETSI addresses the ICT domain with particular focus on the communications aspects for connected devices and the networks that connect them.

text: A European Standard (EN) ‘carries with it the obligation to be implemented at national level by being given the status of a national standard and by the withdrawal of any conflicting national standard’. Therefore, a European Standard (EN) automatically becomes a national standard in each of the 34 CEN-CENELEC member countries.

text: ESO deliverables also include the following.

text: • CEN/CENELEC Workshop Agreement (CWA): a CWA is a CEN-CENELEC agreement, developed by a workshop, which reflects the agreement of identified

text: RISK MANAGEMENT STANDARDS

text: individuals and organisations responsible for its contents. A CWA does not have the status of a European Standard and CEN-CENELEC national members are not obliged to withdraw national standards in conflict with a CWA. • ETSI Standard (ETSI ES) and ETSI Guide (ETSI EG) are ETSI deliverables adopted after weighted voting by ETSI members. • An ETSI Technical Specification (ETSI TS) and an ETSI Technical Report (ETSI TR) are ETSI deliverables adopted by the responsible Technical Body.

text: Within the three European SDOs, CEN-CENELEC Joint Technical Committee 13 ‘Cybersecurity and Data Protection’ (CEN-CLC JTC 13) has published several standards in the area of risk management (see Annex A), most of them having been adopted from SC 27 publications. ENISA maintains a strong liaison with JTC 13 and maintains regular contact.

text: 4.1.2 International SDOs and Standards

text: An International Standard (IS) is a document that has been developed through the consensus of experts from many countries and has been approved and published by one of the globally recognised international SDOs:

text: ISO: the International Organization for Standardization (ISO) is an independent international organisation, with a membership of 165 national standards bodies, that develops voluntary, consensus-based international standards. Within ISO, TC 292 provides a family of standards in the area of risk management (e.g. ISO 31000) while most cybersecurity related activities take place within subcommittee SC 27 of Joint (with IEC) Technical Committee 1 (ISO/IEC JTC1/SC27). ENISA liaises with SC 27 and maintains regular contact. • IEC: the International Electrotechnical Commission (IEC) develops international standards for all electrical, electronic and related technologies. • ITU (the International Telecommunication Union): has a Study Group SG17 – Security where areas of cybersecurity are discussed. Currently this SDO is relatively less advanced in the field of cybersecurity and thus can be considered as a secondary priority.

text: Deliverables also include:

text: • Technical Specifications: a Technical Specification (TS) developed by an international SDO addresses work still under technical development, or where it is believed that it will eventually be transformed and republished as an International Standard. • Technical Reports: a Technical Report (TR) is more informal than an IS or TS; it may, for example, include data from an informative report or information on the perceived ‘state of the art’.

text: 4.1.3 National standardisation bodies and specialised agencies

text: National standardisation bodies and specialised agencies in the EU are also directly represented in the ESOs and, in many instances, their national publications eventually become European Norms or International Standards. However, the inventory established in Annex A of this document refers to several risk management standards available solely from national standardisation bodies and specialised agencies. Examples of such bodies include the following.

text: • BSI: the Federal Office for Information Security (BSI) in Germany is a national cyber security authority, promoting IT security in Germany and also developing cybersecurity standards and guidelines. BSI standards and technical reports are available at no cost from www.bsi.bund.de.

text: RISK MANAGEMENT STANDARDS

text: • NIST: the National Institute of Standards and Technology (NIST) is part of the US Department of Commerce. Its Information Technology Laboratory (ITL) is one of six research laboratories within NIST. ITL has seven divisions including the Applied Cybersecurity Division (ACD) and the Computer Security Division (CSD), both developing cybersecurity standards and guidelines. CSD publications include the Risk Management Framework NIST SP 800-37. NIST standards and guidelines are available at no cost from www.nist.gov. • ANSSI (Agence Nationale de la Sécurité des Systèmes d’information), the French National Cybersecurity Agency has been involved in risk management methodology and processes. In particular ANSSI has been promoting the EBIOS risk manager methodology.

text: 4.1.4 Industrial bodies

text: Industrial bodies and fora are not considered formally as SDOs; however, they offer de-facto standards in certain areas including risk management. Where applicable, the output of industrial bodies is included in the inventory established in Annex A of this document.

text: As an example, OASIS began as a consortium of vendors and users and today is a large nonprofit standards organisation advancing projects for, among others, cybersecurity, blockchain, IoT, emergency management, and cloud computing. OASIS often submits specifications produced by its TCs to other standards bodies (e.g. ISO/IEC JTC 1, ITU-T, ETSI) for additional ratification.

text: In particular, the OASIS TC Collaborative Automated Course of Action Operations (CACAO) for Cyber Security aims to create standards that implement the course of action playbook model for cybersecurity operations.

text: A second example is the Institute of Electrical and Electronic Engineers Standards Association (IEEE SA), an entity within IEEE that develops global standards in a broad range of areas. As with OASIS, some IEEE specifications are submitted to ‘official’ SDOs for additional ratification, such as IEEE/ISO/IEC 16085:2020 - Systems and software engineering - Life cycle processes - Risk management.

text: Important work in the area of risk management is also undertaken by GSMA,

text: 4.1.5 The Risk Management Standards Inventory

text: Annex A of this document provides an inventory of almost fifty identified standards which relate to risk management. The documents are characterised by:

text: • document source, e.g. national standard, European standard, international standard; • document type, e.g. standard, technical specification, technical report; • document scope, e.g. risk management vocabulary and guides, risk management requirements, risk management evaluation methodology.

text: The inventory also provides information about applicable technical domains, document history, and relevancy to EU legislation.

text: The following standards in the inventory are considered most relevant for risk management in the context of information and cybersecurity and are thus labelled ‘Risk management’ in column E (document scope) of the table.

text: • ISO/IEC 27005 – Information security risk management This document was developed using ISO/IEC JTC 1/SC 27 and provides general

text: RISK MANAGEMENT STANDARDS

text: guidelines for information security risk management in an organisation without promoting any specific risk management method. • ISO 31000 – Risk management guidelines This document was developed by ISO TC 292 and provides principles, a framework and a process for managing risk from a general perspective. The Australian and New Zealand version AS/NZS ISO 31000:2009 is identical to and reproduced from ISO 31000:2009. • BSI 7799-3 – Guidelines for information security risk management. • NIST SP 800-39 – Managing Information Security Risk This document developed by NIST provides guidance for an integrated, organisationwide programme for managing information security risk to organisational operations. • BSI Germany Standard 200-3 – Risk analysis based on IT-Grundschutz This methodology developed by the German Federal Office for Information Security demonstrates how the threats listed in the IT-Grundschutz Catalogues can be used to carry out a simplified analysis of risks for information processing.

text: 4.1.6 Risk management methodologies and tools

text: The main goal of risk management is (in general) to protect ICT products (software, hardware, systems, components, services) and business assets, and minimise costs in cases of failures. Thus it represents a core duty for successful business or IT management. Hence, risk management describes a key activity for security within organisations and it is essentially based on the experience and knowledge of methods of best practice and the tools that can be used.

text: These methods consist of an estimation of the risk situation based on the business process models and the infrastructure within the organisation. In this context, these models support the identification of potential risks and the development of appropriate protective measures. The major focus lies on companies and the identification, analysis and evaluation of threats to their respective corporate values.

text: The outcome of a risk analysis is in most cases a list of risks or threats to a system, together with the corresponding probabilities. International standards in the field of risk management are used to support the identification of these risks or threats as well as to assess their respective probabilities. These standards (see Annex A) range from general considerations and guidelines for risk management processes to specific guidelines for the IT sector (all the way to highly specific frameworks as, for example, in the maritime sector. Most of these standards specify framework conditions for the process of risk management but rarely go into detail on specific methods for the analysis or assessment of risk. This is one reason differences in the assessment of risk often arise within specific areas of application, making a direct comparison of the results difficult.

text: In practice, choosing the right method and the right tool for the analysis and evaluation of risk proves to be complicated. In recent years, a number of concepts, algorithms and tools have evolved from research, which have been especially designed to protect the ICT infrastructure and related systems. Since their historical background is settled in a business context, in these methods a quantitative risk assessment is usually performed based on monetary costs (e.g. EBIOS method and the aforementioned ISO / IEC 27005:2013 standard). In this context, most of the methods and tools just use the commonly known rule of thumb ‘risk = probability x potential damage’. Depending on the applied method, the terms and scales for the assessment of the probabilities as well as the potential damage are predefined (such as in the NIST policy or in the Mehari method).

text: In order to structure the process of risk assessment, various attempts have been made to use a Bayesian approach for determining threat probabilities. For example the OCTAVE method is based on subjectively estimated probabilities and thus can be understood as an apriori distribution with regards to the Bayesian approach. The OCTAVE method uses UML as a

text: RISK MANAGEMENT STANDARDS

text: modelling language and represents a comprehensive collection of tools and best practice methods for risk management. The ‘BowTie’ is a traditional widely used qualitative risk analysis method. The CORAS method allows the integration of several different risk assessment processes, whereas the identification of the probability of an attack is not done automatically but apriori to any risk assessment.

text: Contrary to the aforementioned general and IT-specific guidelines for risk management, security and risk management in various sectors emphasise different aspects in the RM methods. For example, the maritime sector traditionally lays a big emphasis on physical and object security. In particular, the International Ship and Port Facility Security (ISPS) Code define a set of measures to enhance the security of port facilities and ships. It is only this year that IMO published RM guidelines for the cyber assets of ships.

text: A sole focus on physical security is not sufficient any more in any sector due to the digitalisation and security of the cyber-physical systems becoming equally important. Thus RM need to cover all aspects. In this section we will present the main RM methodologies in terms of their main characteristics, usability, resources needed, standards applies and implementation aspects (supported by tools).

text: As explained in section 2.3, there are three options for the risk management analysis of methodologies.

text: Option 1: Methodology is used to achieve conformance to a standard (referencing in part or in whole to a certain standard and its requirements).

text: Expression des Besoins et Identification des Objectifs de Sécurité (EBIOS) Risk Manager

text: EBIOS Risk Manager is an information security risk management method, created under the French General Secretariat of National Defence, consistent with ISO 31000 and ISO/IEC 27005, and enables the risk management requirements of ISO/IEC 27001 to be met.

text: • It allows to: o establish the context (objectives, scope, critical and supporting assets on which they are based, etc.) and deal with standard and accidental risks by assessing compliance with the rules to which organisations have committed themselves; o assess targeted and sophisticated risks:  by studying and reconciling the points of view of the attacker (sources of risk) and the defender (feared events, sources of risk and their intended objectives);  by successive refinements (strategic scenarios studying the possible attack paths of the sources of risk through the ecosystem of stakeholders, and operational scenarios studying in detail the attack chains that allow them to be implemented in practice);  estimating their severity and likelihood; o deal with them in a proportionate manner, allowing the various components of the risks identified to be dealt with as the studies are carried out and completing the coverage of the risks in a coherent manner through an action plan; o accept the residual risks through a decision informed by the previous steps; o communicate risks, as it is participatory and involves several stakeholders (management, business, IT, security, legal, communication, etc.), and provide intelligible results to the recipients of the studies;

text: RISK MANAGEMENT STANDARDS

text: o monitor and review risks as a principle of continuous improvement, by identifying the risks to be monitored and by providing for the conditions for updating the studies. • More than a method, it is a methodology used as a toolbox whose terminology, techniques, sequence, knowledge bases and manner of presenting the results will be adjusted according to the object of the study (an entire organisation, a specific system, a technical component, etc.) and its context.

text: Method for the Harmonised Analysis of Risk (MAGERIT)

text: Magerit is an open methodology for risk analysis and management developed by the Spanish Higher Council for Electronic Government and offered as a framework and guide to the public administration. It is the answer to the increasing dependency of public and private organisations on information technologies to fulfil their mission and reach their business objectives.

text: Magerit users undertake the responsibility running the risk analysis process via workshops and interviews, with specific representatives of the organisation participating only in specific phases of the assessment process. It is compliant with ISO/IEC 27005, covers all the requirements defined by the ISO/IEC 27001, and conforms with the code of implementation of an ISMS specified by ISO/IEC 27002:2005.

text: Option 2: Methodology is given as a standard and can be used to achieve conformance to a standard and its requirements.

text: NIST 800-30 Methodology

text: NIST 800-30 is a free guide that provides a foundation for the development of an effective risk management programme, containing both the definitions and the practical guidance necessary for assessing and mitigating risks identified within IT systems. The ultimate goal is to help mostly large scale organisations (such as governmental agencies and large companies) to better manage risks associated with IT-related missions.

text: The method is compliant with the ISO/IEC 27001.

text: Option 3: Methodology is a set of good practices but not related to any standard and not used to achieve conformance.

text: Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Method

text: OCTAVE is a free of charge approach to evaluations of information security risk that is comprehensive, systematic, context-driven, and self-directed. The approach is embodied in a set of criteria that define the essential elements of an asset-driven evaluation of an information security risk.

text: CCTA Risk Assessment and Management Methodology (CRAMM)

text: CRAMM is a method that an analyst or group of analysts may use to evaluate the security and risk level of an organisation by analysing and combining the diverse knowledge distributed in the local corporate environment. The computational method and technique that has been adopted by CRAMM for the correlation and the determination of the results is quite primitive and is based on a qualitative approach. CRAMM complies with the rules and obligations imposed by the ISO/IEC 27001 standard.

text: IT-Grundschutz

text: RISK MANAGEMENT STANDARDS

text: IT-Grundschutz has been developed by the Federal Office for Information Security in Germany. IT-Grundschutz provides a configuration for the establishment of an integrated and effective IT security management. The method, before starting the risk analysis, involves a basic security check to verify the security measures that have been implemented. Risk assessment identifies the threats which have not been avoided by the measures, such as residual threats.

text: These threats can be eliminated by additional security measures. In this way, risk will be reduced to an acceptable level. IT-Grundschutz adopts a qualitative risk analysis approach that is associated with a primitive computational technique for the analysis and correlation of the assessment information. The method is compliant with ISO/IEC 27001 as it addresses the defined requirements as well as being suitable for the implementation of the ISMS process described in ISO/IEC 27002.

text: MEHARI

text: MEHARI is a free of charge qualitative risk analysis and management method developed by CLUSIF (Club for the Security of Information in France/Club de la Sécurité de l'Information Français). MEHARI provides a consistent methodology, with appropriate knowledge bases such as manuals and guides that describe the different modules (stakes, risks, vulnerabilities) that has been designed to assist people involved in security management (CISOs, risk managers, auditors, CIOs), in their various tasks and actions. The methodology is suitable for the implementation of the ISMS process described by ISO/IEC 27001.

text: Information Security Assessment and Monitoring Method (ISAMM)

text: ISAMM is a quantitative type of risk management methodology that can be applied by various organisations such as governmental agencies, large companies and small and medium size enterprises. ISAMM is compliant with ISO/IEC 27002 and provides maximal support of the ISO/IEC 27001 ISMS standard. It is also supported by a freeware tool.

text: 4.2 OTHER SYSTEMS AND TOOLS SUPPORTING RM

text: Baldrige Cybersecurity Excellence Builder (BCEB) is a self-assessment tool to help organisations better understand the effectiveness of their cybersecurity risk management efforts and identity opportunities for improvement in the context of their overall performance.

text: Common Vulnerabilities and Exposures (CVE) system provides a reference-method for publicly known information-security vulnerabilities and exposures. It is a list of publicly disclosed computer security flaws with a CVE ID number assigned by a CVE numbering authority (CNA). There are about 100 CNAs, representing major ICT vendors, security companies and research organisations. MITRE also issues CVEs directly. A single complex ICT product, such as an operating system, can accumulate many CVEs.

text: Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities. CVSS is well suited as a standard measurement system for industries, organisations and governments that need accurate and consistent vulnerability severity scores.

text: Security Content Automation Protocol (SCAP) is a synthesis of interoperable specifications derived from community ideas. This site contains information about both existing SCAP specifications and emerging specifications relevant to NIST's security automation agenda.

text: OWASP threat modelling tool is an open source tool that works to identify, communicate and understand threats and mitigations within the context of protecting something of value. Threat modelling can be applied to a wide range of things, including software, applications, systems, networks, distributed systems, things in the Internet of things, business processes, etc.

text: RISK MANAGEMENT STANDARDS

text: Factors Analysis in Information Risk (FAIR Privacy) is a quantitative privacy risk framework based on FAIR (Factors Analysis in Information Risk). FAIR Privacy examines personal privacy risks (to individuals), not organisational risks. Included in this tool is a PowerPoint deck illustrating the components of FAIR Privacy and an example based on the US Census. In addition, an Excel spreadsheet provides a powerful risk calculator using Monte Carlo simulation.

text: SRAQ Online Risk Calculator adopts a technical approach to RA; it covers four areas: identification of threats; development of system diagrams; recommendation of controls; creation of risk treatment plan.

text: Vulnerability registers and databases underpin the success of risk assessment which relies on these registers and databases and on the formats, metrics and procedures used in these registers and databases. They play an important role in the assessment and management of risk since they provide a unique identifier for each vulnerability, a structured and machine-readable format for the information and, typically, a number of references to fixes and patches. There are global registers such as MITRE CVE, NVD and CNNVD as well as national and commercial registries but no EU registry.

text: Sector specific prototypes for RM tools have been developed in various EC H2020 projects. These include the following.

text: CYSM emphasises the protection of port facilities, based on the provision of a dynamic risk management methodology for ports’ CII considering their physical-cyber nature. It implements ISO 27001, ISO27005 and ISPS. The CYSM RA tool is based on a set of interactive and collaborative technologies.

text: MEDUSA focuses on the protection of the port supply chain. It defines a methodological approach to the identification of the multi-order dependencies of security incidents and risks, within the scope of multi-sector cross-border scenarios. It is reflected in the provision of support for ISO28000. MEDUSA is based on a set of visualisation tools and techniques to model and simulate the supply chain scenarios of ports.

text: MITIGATE enhances CYSM and Medusa towards protecting port facilities within the scope of interacting supply chains. MITIGATE adopts an evidence-driven maritime supply chain risk assessment model in order to capture and deal with cascading effects risks, threats and vulnerabilities, associated with the ICT-based maritime supply chain. It implements ISO 27001, ISO27005 and IOS28000 and incorporates a set of ICT technologies, including semantic web technologies (for ontology management, context management and profiling), cloud computing and BigData and crowd-sourcing technologies (i.e. in order to collect and analyse open information from public resources)

text: Cyberwatching Cyber Risk Temperature Tool is a tool developed for SMEs so they can easily identify threats and estimate their risks.

text: RESISTO implements an innovative decision support system to protect communication infrastructures from combined cyber-physical threats exploiting the Software De-fined Security model on a suite of state-of-the-art cyber-physical security components (Blockchain, Machine Learning, IoT security, Airborne threat detection, holistic audio-video analytics) and services.

text: FINSEC is a tool box that can be used by the financial sector. It implements an RA methodology based on the enhancement and integration of various existing tools for anomaly detection, AI CCTV analytics, risk assessment engines, collaborative analysis and management of risk.

text: There are global registers such as MITRE CVE, NVD, CNNVD. Many MSs have their own registries (national and regional) that are not connected or interoperable as has been realised

text: RISK MANAGEMENT STANDARDS

text: through an on-going study by ENISA on ‘Vulnerability Disclosure Policies and Vulnerability Databases’. Moreover, there is no EU registry that all EU vendors can use to report new vulnerabilities. The national and regional registries are neither interoperable nor connected.

text: 4.3 PRACTICAL USE OF STANDARDS AND METHODOLOGIES

text: Risk management standards and methodologies can be used for several purposes in an entity:

text: • Setting up or reinforcing a management process for the digital risk within an organisation, • Assessing and treating the risks relating to a digital project, in particular with the aim of a security accreditation, • Defining the level of security to be achieved for a product or service according to its particular uses and the risks to be countered, from the perspective of certification or accreditation for example.

text: Before going on to the different steps of a practical implementation, it is important to understand the two main actors of the ICR possible risks, threat agent and the asset

text: 1) The flow from threat agent to exposure of the asset

text: This diagram illustrates the various steps and causal relationship between the threat agent and the exposure of the asset, which is commonly known as a ‘cyberattack’. The risk management and the associated methodology and tools are a set of requirements to be followed to estimate the level of risk that an entity is facing.

text: 2) The threat agents can have different aspects and levels, depending on the value of the targeted assets.

text: RISK MANAGEMENT STANDARDS

text: It is interesting to see the evaluation of bank branches in the 1980s. The bank offices had several security functions that people had to go through before being able to enter the office. The asset to protected was the physical money. The banks performed risk analysis and realised that the only asset to be protected was the physical money and so they removed it from the hands of the employees. Now you can enter in any bank without going through any security functions as the physical money is managed by the ATM and bank employees don’t have access to it.

text: This example illustrates why it is important to first identify the assets that are to be protected. If there is no asset then there is no risk.

text: The necessary steps to be conducted by any entity when starting its risk analysis can be summarised as below):

text: • Item 1: Identification of the critical assets (data, material, place, people); • Item 2: Identification of the threats of these critical assets; • Item 3: Definition of the occurrence and the importance of this threats to calculate a rate of risk; • item 4: Decision on risk mitigation (reduce, accept, transfer); • Item 5: Planification of business continuity plan and business resumption plan; • Item 6: Definition of the IT cartography or the product usage environment.

text: In order to perform these six steps, the practical use of the ISO/IEC 27005 Risk Management Standard associated with the EBIOS RM assessment methodology can be applied. As the EBIOS Risk Management Assessment methodology is based on the ISO/IEC 27005 and fully compliant, the entity does not have to know the ISO/IEC 27005 standard to perform its Risk mitigation analysis.

text: The EBIOS RM methodology adopts an iterative approach that revolves around five workshops.

text: RISK MANAGEMENT STANDARDS

text: Figure 1 — An iterative approach in five workshops - Source ANSSI

text: WORKSHOP 1 The first workshop aims to identify the studied object, the participants in the workshops Scope and and the timeframe. During this workshop, you will list the missions, business assets and security supporting assets related to the studied object. You identify the feared events associated baseline with the business assets and assess the severity of their impacts. You also define the security baseline.

text: WORKSHOP 2 In the second workshop, you identify and characterise the risk origins (RO) and their Risk origins high-level targets, called target objectives (TO). The RO/TO pairs deemed the most relevant are selected at the end of this workshop. The results are formalised in a mapping of the risk origins.

text: WORKSHOP 3 In workshop 3, you will get a clear view of the ecosystem and stablish a mapping of the Strategic digital threat of the latter with respect to the studied object. This will allow you to scenarios construct high-level scenarios, called strategic scenarios. They represent the attack paths that a risk origin is likely to take to reach its target. These scenarios are designed at the scale of the ecosystem and the business assets of the studied object. They are assessed in terms of severity. At the end of this workshop, you can already define the security measures on the ecosystem.

text: WORKSHOP 4 The purpose of workshop 4 is to construct technical scenarios that include the methods of attack that are likely to be used by the risk origins to carry out the strategic scenarios.

text: Operational

text: This workshop adopts an approach similar to the one in the preceding workshop but

text: scenarios

text: focuses on critical supporting assets. You then assess the level of likelihood of the operational scenarios obtained.

text: RISK MANAGEMENT STANDARDS

text: NOTE: 1) Workshops 3 and 4 are naturally applied during successive iterations. 2) Workshops 2, 3 and 4 make it possible to assess the risks, which constitute the last stage of the digital risk management pyramid. They use the security baseline according to different attack paths, which are relevant with regards to the threats considered and in a limited number in order to facilitate the analysis.

text: WORKSHOP 5 The last workshop consists in creating a summary of all of the risks studied in order to Risk mitigation define a risk mitigation strategy. The latter is then broken down into security measures written into a continuous improvement plan. During this workshop, you establish a summary of the residual risks and define the framework for monitoring risks.

text: This series of five iterative workshops is summarised here below:

text: Figure 2: Link between the various workshop – source EBIOS RM - ANSSI

text: To support and implement this methodology you can use a simple table file. Some software editors also provide dedicated software that is available in Software as a Service mode or local mode.

text: RISK MANAGEMENT STANDARDS

text: 5. RESULTS OF THE ANALYSIS

text: This section analyses the gaps and overlaps between the risk management standards determined in section 4.1.5.

text: When analysing the documents discussed earlier, the distinction between risk management standards and risk management methodologies becomes quite obvious. The relevant standards are:

text: • ISO/IEC 27005 – Information security risk management, • ISO 31000 – Risk management guidelines, • BSI 7799-3 – Guidelines for information security risk management, • NIST SP 800-39 – Managing information security risk, • BSI Germany Standard 200-3 – Risk analysis based on IT-Grundschutz.

text: Their analysis in this section is performed from various perspectives:

text: • concepts, terms and definitions, • risk criteria, • areas of application, • ICT, • level of application, • European vs international technical specifications, • EU legislation vs standards.

text: Concepts, terms and definitions

text: All the identified risk management standards have influenced each other over the years. The concepts, terms and definitions related to risk management outlined in ISO 31000 have been incorporated in all of these other documents in more or less the same way.

text: Slight deviations exist depending whether the risk management standards analysed are more related to or in support of management system standards based on ISO Directives or those based on a risk management framework according to ISO 31000. This difference becomes quite obvious when reading the diverging definitions of risk, but this distinction has no real-life implications and can be viewed as a rather academic issue.

text: The risk management methodologies and tools do diverge to a much greater extend from each other. This can mostly be attributed to the fact that these methodologies and tools have been developed by different entities addressing different audiences and their needs. Not every methodology or tool is universally applicable to any type or size of organisation and its scope.

text: In the ENISA report Methodology for Sectoral Cybersecurity Assessments 2021 an overview of terms is provided, along with an interpretation of the meaning of each term according to the normative references found in ISO/IEC 270xx. In addition, how these definitions should be understood and used in the context of the specification of security and assurance is explained.

text: RISK MANAGEMENT STANDARDS

text: Risk Criteria

text: All risk management standards recommend the determination of risk criteria, although no recommendation or requirement regarding the criteria themselves or the necessary levels or threshold values are stated. According to the risk management standards, this remains a task for the organisation implementing risk management.

text: The risk management methodologies and tools may have outlined these risk criteria – including the levels and threshold values – within their content. Depending on the audience for a methodology or tool, these criteria can be defined exactly for the specific area of application, such as a specific business sector.

text: The various RA methodologies adopt different measurement and scales so as a result risk levels estimates cannot be compared. These differences lead to selecting and implementing different controls (some of them costlier that others) to mitigate the same risks. This problem affects certification efforts as well. CVSS3.0 is being used broadly for scoring the severity of vulnerabilities; however, it has not been adopted by all stakeholders.

text: Areas of application

text: All the risk management standards that have been identified can be applied by any organisation in any business sector as these standards provide guidance on the framework for risk management.

text: The situation is similar for organisations implementing risk management in the context of a management system when seeking conformance to a management system standard.

text: Some methodologies and tools may be applicable only to a specific business sector. Others also address ICT-risk from a cross-sector perspective.

text: The transversal standards intend to cover a large set of domains by being as generic and reusable as possible. This is the case of standards developed by ISO/IEC JTC1/SC27 (ISO/IEC 27000 family, ISO/IEC 15408/18045) or by CEN CENELEC EN 17640 FITCEM or ETSI EN 303 645. Despite this fact it appears that for specific domains (automotive, aeronautics and space, energy, sustainable industry, supply chain etc.), these standards are not sufficient and must be supplemented with additional security requirements, and evaluation and assessment methods. This can be due to specific features, regulations, user requirements or technology constraints.

text: ICT

text: There are many standards on ICT security (e.g. ISO/IEC 11770-3:2021) that provide accurate technical information to ensure the security of ICT mechanisms and also several sector-specific standards due to ISO /IEC 27002 Code of Practice for information security controls, e.g. ISO/IEC 27011. They support managing ICT security risks by offering appropriate technology and related mechanisms but they are not risk management standards.

text: ETSI TS T02 165-1 (2017) is a technical specification which defines a method for analysing the risks of information and communications technology (ICT) systems using the threat, vulnerability and risk analysis (TVRA) methodology. Primarily, this is a guidance for analysing threats applicable to and vulnerabilities identified in a target of evaluation considered within the Common Criteria evaluation methodology (ISO/IEC 15408 family). But there is no equivalent standard considering ICT systems in a more general context.

text: RISK MANAGEMENT STANDARDS

text: There are several sector-specific standards due to ISO /IEC 27002 Code of Practice for information security controls, e.g. ISO/IEC 27011 (Code of practice for Information security controls based on ISO/IEC 27002 for telecommunications organisations) and ISO/IEC 27017 (Code of practice for information security controls based on ISO/IEC 27002 for cloud services). There are some standards applying risk management to technology, e.g. ISO 14971 (Medical devices — Application of risk management to medical devices) and ISO 17666 (Space systems — Risk management). But there is a gap due to the absence of a standard applying risk management to ICT devices, ICT services and ICT processes to support the assessment and treatment of corresponding risks.

text: The following results can be observed in several organisations:

text: 1. Lack of coordination and alignment between the divisions responsible for business risk management or information security management and ICT staff regarding risk management; 2. Lack of conformity with regard to risk management language and the application of risk management between the divisions responsible for business risk management or information security management and ICT staff.

text: Level of application

text: As risk management standards only provide guidance on the framework, these standards can be used by the whole of a legal entity from the perspective of its business, its services or products, or be limited to its IT-operation only.

text: Depending on the audience and the intended use of a methodology or tool, similar organisational levels can be addressed. Some tools cover all aspects of a management system – such as management system risks, strategic risk and operational risks – others only address operational risk for ICT-operations.

text: European vs international technical specifications

text: Out of the five risk management standards as determined, two are published by ISO, whereas three standards are published by individual countries. None of these publications have any legal basis throughout the European Union.

text: The situation poses similar problems regarding methodologies and tools.

text: Section 4.1.5 has identified ISO 31000 Risk Management Guidelines and ISO/IEC 27005 Information Security Risk Management as being the most relevant risk management standards in the international domain, providing basic principles and generic guidelines. Unlike many other international cybersecurity standards which have been adopted as European Norms, such adoption has not happened in these two cases; however ISO 31000 was, for example, adopted as a regional standard for Australia and New Zealand.

text: EU legislation versus standards

text: The EU’s NIS directive uses its own definition of risk which is not aligned with any of the other definitions. For example, The definition of ‘risk’ is not uniform between the NIS directive and ISO/IEC 27001 and ISO/IEC 27005. This issue may be rather academic but it can also create some difficulties in bridging the regulatory context and the standardisation context.

text: RISK MANAGEMENT STANDARDS

text: The risk-based approach is promoted in most of the recent efforts on digital legislation. As an example, the IA Act defines four levels of risk: unacceptable risk, high risk, limited risk, and minimal risk. To classify these four levels, an agreed quotation methodology should be developed and, as of today, no standard is available nor is one in preparation.

text: RISK MANAGEMENT STANDARDS

text: 6. RECOMMENDATIONS

text: Basing on the analysis provided in section 5, we propose the following recommendations on the use of risk management standards for various groups of stakeholders.

text: 6.1 EU POLICY MAKERS

text: Recommendation 1:

text: EU policy makers should use risk management standards that have already been adopted in future regulatory publications.

text: Note: This requires the successful implementation of recommendation 8.

text: Recommendation 2:

text: EU policy makers should make particular risk assessment methodologies or tools mandatory for specific sectors, where and when necessary.

text: Recommendation 3:

text: When no risk management standard or risk assessment methodology or tool is appropriate for a specific sector, EU policy makers should issue a request for standardisation to ESOs to cover this need.

text: As an example – a European standard for a methodology for the assessment of ICT security is missing. Such a European standard would allow a coherent approach to be made to comply with the risk management obligation set out in different existing and upcoming cybersecurity pieces of legislation. This methodology should be based on the ISO/IEC 27005 Information security risk management and ISO/IEC ISO.IEC 31000 – Risk management guidelines.

text: Recommendation 4:

text: In the context of the Cybersecurity Act, one of the crucial actions should consist in verifying whether European standards to apply risk management to ICT devices, ICT services and ICT processes, which aim to support the assessment and treatment of corresponding risks, actually exist. Otherwise, the EU Policy makers should issue a request for standardisation to ESOs to cover this need.

text: Recommendation 5:

text: Cybersecurity education and practical skills need to be aligned and embedded in all educational stages (from early childhood to lifelong learning) and during the whole professional life. All educational enterprises in the MSs and all EU citizens from all sectors (e.g. health, government, transport, finance, defence) need to have the opportunity to practice in national or clustered EU cyber ranges to assess their skills. Risk management, based on the recognised standards, should become one of the main topics of these activities.

text: Recommendation 6:

text: An ad hoc working group should be set up (preferably by ENISA) to determine some criteria to define the levels of risks mentioned in European legislation (e.g. Artificial Intelligence Act). This ad hoc working group should provide the necessary risk tools to compute the estimation of the risk and to classify the results accordingly to the levels identified.

text: RISK MANAGEMENT STANDARDS 6.2 EUROPEAN SDOS

text: Recommendation 7:

text: As identified earlier, security concepts (units of knowledge consisting of unique characteristics), terms (verbal designations of the concepts), definitions (unique descriptive statements of the concepts that identify them uniquely) and relations between concepts in different risk assessment standards deviate among themselves as used by various SDOs. Further interpretation efforts are needed for all risk assessment and risk management standards that appear in this document. The SDOs are encouraged to use unified concepts, terms and definitions. The concept approach, developed by the ISO Technical Committee TC37 Language and Terminology, can be adopted where one term corresponds to one concept and only one concept corresponds to one term.

text: Recommendation 8:

text: There is no existing European standard for a methodology to assess ICT security available at the European level, creating some issues in referencing applicable standards in EU legislation. As described in chapter 4.2 there are several methodologies with different approaches. Efforts should be undertaken to address these gaps.

text: Recommendation 9:

text: ESOs should adopt ISO/IEC 31000 and ISO/IEC 27005 as European Norms. The benefits of such regional adoption in the case of European Norms include the facts that: • harmonisation within Europe makes it easier to comply with European rules and regulations (stand-still on national work on the same topic); • documents can be targeted at European needs; • consensus building within Europe is easier than in the global context. The potential adoption of ISO/IEC 31000 and/or ISO/IEC 27005 as European standards will help to harmonise European approaches to risk management.

text: Recommendation 10:

text: ETSI should harmonise its TS 102 165-1 with ISO 31000 and ISO/IEC 27005 to develop a standard covering risk management for ICT systems which is applicable to systems in a Common Criteria context as well as in risk management (asset-based approach) within the scope of an ISMS.

text: 6.3 ENISA

text: Recommendation 11:

text: ENISA should publish, on a regular basis, an overview of endorsed risk management standards covering different domains and sectors.

text: Recommendation 12:

text: ENISA should publish an overview of endorsed methodologies and tools covering different domains and sectors.

text: RISK MANAGEMENT STANDARDS

text: Recommendation 13:

text: ENISA should encourage and support different disciplines and sectors to develop or advance work regarding their assessment of sector-discipline-specific risk and methodologies and tools for treating risk, in order to increase cooperation between stakeholders.

text: Recommendation 14:

text: ENISA should continue to work in close support with ESOs in fulfilling potential EU requests for standardisation related to the management of risk.

text: Recommendation 15:

text: ENISA should establish a mechanism for assisting EU institutions, bodies and agencies, EU Member States and private organisations regarding various aspects of risk management.

text: RISK MANAGEMENT STANDARDS

text: ANNEX A: INVENTORY OF RISK MANAGEMENT RELATED STANDARDS

text: This annex lists the standards and technical specifications related to risk management. A full table, including additional information (such as the interrelation with other documents, current version, website link and others is available for download separately from the ENISA website.

text: Name of the Document Name Document type Document scope publishing Short description reference Organisation

text: This international standard specifies basic terminology, principles and a methodology for Safety of machinery — General achieving safety in the design of machinery. It principles for design — Risk ISO 12100:2010 Standard Guidelines ISO specifies principles of risk assessment and risk assessment and risk reduction reduction to help designers in achieving these objectives. This document specifies general principles of risk assessment for systems involving structures. The focus is on strategic and operational Bases for design of structures — decision-making related to the design, General principles on risk General risk assessment assessment, maintenance and decommissioning ISO 13824:2020 Standard ISO assessment of systems involving framework of structures. This also includes formulation and structures calibration of related codes and standards. Systems involving structures can expose stakeholders at various levels in society to significant risks. This document specifies terminology, principles and a process for risk management of medical devices, including software as a medical device Medical devices — Application of and in vitro diagnostic medical devices. The ISO 14971:2019 Standard Guidelines ISO risk management to medical devices process described in this document is intended to assist manufacturers of medical devices to identify the hazards associated with a medical device, to estimate and evaluate the associated

text: RISK MANAGEMENT STANDARDS

text: risks, to control these risks, and to monitor the effectiveness of the controls.

text: Defines the principles and requirements for Space systems — Risk management ISO 17666:2016 Standard Requirements ISO integrated risk management on a space project. Outputs resulting from this international standard will be the following: i) A Statement of Coverage that defines the boundaries of the supply chain that is covered by the security plan; ii) A Security Assessment that documents the vulnerabilities of the supply chain to defined Specification for security security threat scenarios which also describes Requirements and management systems for the supply ISO 28001:2007 Standard ISO the impacts that can reasonably be expected guidance chain from each of the potential security threat scenarios; iii) A Security Plan that describes security measures in place to manage the security threat scenarios identified by the Security assessment; iv) a training programme setting out how security personnel will be trained to meet their assigned security related duties. ISO 28004-2:2014 identifies supply chain risk Security management systems for and threat scenarios, procedures for conducting the supply chain — Guidelines for assessments of risks and threats, and evaluation the implementation of ISO 28000 — ISO 28004-2:2014 Standard Guidelines ISO criteria for measuring the conformance and Part 2: Guidelines for adopting ISO effectiveness of the documented security plans 28000 for use in medium and small in accordance with ISO 28000 and the ISO 28004 seaport operations series implementation guidelines. ISO 31000:2018 provides guidelines on managing the risks faced by organisations. The Risk Management Guidelines ISO 31000 Standard Guidelines ISO application of these guidelines can be customised to any organisation and its context. ISO Guide 73:2009 provides the definitions of the generic terms related to risk management. It aims to encourage a mutual and consistent Risk management — Vocabulary ISO Guide 73:2009 Guide/Guidance Vocabulary ISO understanding of, and a coherent approach to, the description of activities relating to the management of risk, and the use of uniform risk management terminology in processes and

text: RISK MANAGEMENT STANDARDS

text: frameworks dealing with the management of risk.

text: This document provides the definitions of generic terms related to the management of risks faced by the organisation. It aims to encourage a mutual and consistent understanding of, and a coherent approach to, Risk management – Vocabulary ISO/DIS 31073 Standard Vocabulary ISO the description of activities relating to the management of risk, and the use of uniform risk management terminology in processes and frameworks dealing with the management of the risks faced by organisations. Application of risk management for This part of ISO/TR 80001 provides guidance for IT-networks incorporating medical a healthcare delivery organisation (HDO) that devices — Application guidance — wishes to self-assess its implementation of the Part 2-7: Guidance for Healthcare ISO/TR 80001-2-7:2015 Technical Report Guidelines ISO processes of IEC 80001-1. This part of ISO/TR Delivery Organizations (HDOs) on 80001 can be used to assess Medical IT-Network how to self-assess their projects where IEC 80001-1 has been conformance with IEC 80001-1 determined to be applicable This document focuses on remote maintenance services (RMS) for information systems in healthcare facilities (HCFs) as provided by vendors of medical devices and health information systems. This document specifies the risk assessment necessary to protect remote Health informatics — Information maintenance activities, taking into consideration security management for remote Technical Requirements and risk the special characteristics of the healthcare field maintenance of medical devices and ISO/TS 11633-1:2019 ISO Specification analysis such as patient safety, regulations and privacy medical information systems — Part protections. This document provides practical 1: Requirements and risk analysis examples of risk analysis to protect the information assets of both HCF and RMS providers in a safe and efficient (i.e. economical) manner. These assets are primarily the information system itself and personal health data held in the information system. This Technical Specification provides a common Guidance on performing risk approach and guidance to those undertaking assessment in the design of onshore Technical ISO/TS 16901:2015 Guidelines ISO assessment of the major safety hazards as part LNG installations including the ship Specification of the planning, design, and operation of LNG to shore interface facilities onshore and at the shoreline using risk-

text: RISK MANAGEMENT STANDARDS

text: based methods and standards, to enable the safe design and operation of LNG facilities.

text: This document gives guidelines for integrating and using ISO 31000 in organisations that have implemented one or more ISO and IEC Risk management — Guidelines on management system standards (MSS), or that using ISO 31000 in management IWA 31:2020 Guidelines ISO have decided to undertake a project systems implementing one or more MSS incorporating IWA Workshop ISO 31000. This document explains how the Agreement clauses of ISO 31000 relate to the high level structure (HLS) for MSS. ISO/IEC 27000:2018 provides an overview of information security management systems (ISMS). It also provides terms and definitions Information security management commonly used in the ISMS family of standards. systems — Overview and ISO/IEC 27000:2018 Standard Vocabulary ISO/IEC This document is applicable to all types and vocabulary sizes of organisation (e.g. commercial enterprises, government agencies, and not-forprofit organisations). ISO/IEC 27001:2013 specifies the requirements for establishing, implementing, maintaining and Information security management ISO/IEC 27001:2013 Standard Requirements ISO/IEC continually improving an information security systems — Requirements management system within the context of the organisation. ISO/IEC 27002:2013 gives guidelines for organisational information security standards Security techniques — Code of and information security management practices practice for information security ISO/IEC 27002:2014 Standard Code of practice ISO/IEC including the selection, implementation and controls management of controls taking into consideration the organisation's information security risk environment(s). ISO/IEC 27004:2016 provides guidelines Information technology — Security intended to assist organisations in evaluating techniques — Information security the information security performance and the management — Monitoring, ISO/IEC 27004:2016 Standard Guidelines ISO/IEC effectiveness of an information security measurement, analysis and management system in order to fulfil the evaluation requirements of ISO/IEC 27001:2013. This document provides guidelines for Security techniques — Information information security risk management. This ISO/IEC 27005:2018 Standard Guidelines ISO/IEC security risk management document supports the general concepts specified in ISO/IEC 27001 and is designed to

text: RISK MANAGEMENT STANDARDS

text: assist the satisfactory implementation of information security based on a risk management approach.

text: ISO/IEC 27006:2015 specifies requirements and provides guidance for bodies providing audit Information technology — Security and certification of an information security techniques — Requirements for management system (ISMS), in addition to the bodies providing audit and ISO/IEC 27006:2015 Standard Requirements ISO/IEC requirements contained within ISO/IEC 17021-1 certification of information security and ISO/IEC 27001. It is primarily intended to management systems support the accreditation of certification bodies providing ISMS certification. ISO/IEC 27013:2015 provides guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1 for those organisations that are intending to either: i) implement ISO/IEC 27001 when ISO/IEC 20000-1 is already implemented, or vice versa, Information technology — Security ii) implement both ISO/IEC 27001 and ISO/IEC techniques — Guidance on the ISO/IEC 27013:2015 Standard Guidelines ISO/IEC 20000-1 together, integrated implementation of iii) integrate existing management systems ISO/IEC 27001 and ISO/IEC 20000-1 based on ISO/IEC 27001 and ISO/IEC 20000-1. ISO/IEC 27013:2015 focuses exclusively on the integrated implementation of an information security management system (ISMS) as specified in ISO/IEC 27001 and a service management system (SMS) as specified in ISO/IEC 20000-1. Information technology — Organisational privacy risk ISO/IEC CD 27557 Standard Requirements ISO/IEC Under development management This technical report provides guidance and criteria for the security evaluation of operational systems. It provides an extension to the scope of ISO/IEC 15408, by taking into account a number of critical aspects of Information technology — Security operational systems not addressed in ISO/IEC ISO/IEC TR 19791:2010 Technical Report Guidelines ISO/IEC techniques — Security assessment 15408 evaluation. The principal extensions that of operational systems are required address evaluation of the operational environment surrounding the target of evaluation, and the decomposition of complex operational systems into security domains that can be separately evaluated.

text: RISK MANAGEMENT STANDARDS

text: Information technology — Process This document provides guidance on the assessment — Guidance for process ISO/IEC TR 33015:2019 Technical Report Guidelines ISO/IEC application of the results of a process risk determination assessment for process risk determination. This document addresses the cybersecurity perspective in the engineering of electrical and electronic (E/E) systems within road vehicles. By Road vehicles — Cybersecurity ensuring appropriate consideration of ISO/SAE 21434:2021 Standard Requirements ISO/SAE engineering cybersecurity, this document aims to enable the engineering of E/E systems to keep up with state-of-the-art technology and evolving attack methods. IEC 31010:2019 is published as a double logo standard with ISO and provides guidance on the selection and application of techniques for assessing risk in a wide range of situations. The techniques are used to assist in making Risk Management – Risk assessment IEC 31010:2019 Standard Techniques IEC decisions where there is uncertainty, to provide techniques information about particular risks and as part of a process for managing risk. The document provides summaries of a range of techniques, with references to other documents where the techniques are described in more detail. This document specifies general requirements Safety, effectiveness and security for organisations in the application of risk in the implementation and use management before, during and after the of connected medical devices or IEC/DIC 80001-1 Standard Requirements IEC connection of a health IT system within a health connected health software — IT infrastructure, by addressing the key Part 1: properties of safety, effectiveness and security Application of risk management whilst engaging appropriate stakeholders. This document describes the cybersecurity evaluation methodology for ICT products. It is intended for use for all three assurance levels as defined in the Cybersecurity Act (i.e. basic, substantial and high). The methodology is Fixed time cybersecurity evaluation comprised of different evaluation blocks prEN 17640 Other Evaluation Methodology CEN-CLC methodology for ICT products including assessment activities that comply with the evaluation requirements of the CSA for the three levels. Where appropriate, it can be applied both to third party evaluation and selfassessment. It is expected that this methodology may be used by different

text: RISK MANAGEMENT STANDARDS

text: candidate schemes and verticals providing a common framework to evaluate ICT products.

text: EN ISO/IEC 27000 provides an overview of information security management systems (ISMS). It also provides terms and definitions Information security management commonly used in the ISMS family of standards. systems — Overview and EN ISO/IEC 27000:2020 Standard Vocabulary CEN-CLC This document is applicable to all types and vocabulary sizes of organisation (e.g. commercial enterprises, government agencies, not-for-profit organisations). EN ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining and Information security management EN ISO/IEC 27001:2017 Standard Requirements CEN-CLC continually improving an information security systems — Requirements management system within the context of the organisation. This document specifies requirements and provides guidance for establishing, Extension to ISO/IEC 27001 and implementing, maintaining and continually ISO/IEC 27002 for privacy improving a privacy information management EN ISO/IEC 27701:2021 Standard Requirements CEN-CLC information management - system (PIMS) in the form of an extension to Requirements and guidelines ISO/IEC 27001 and ISO/IEC 27002 for privacy management within the context of the organisation. EN ISO/IEC 27002 gives guidelines for organisational information security standards Security techniques — Code of and information security management practices practice for information security EN ISO/IEC 27002:2017 Standard Code of practice CEN-CLC including the selection, implementation and controls management of controls taking into consideration the organisation's information security risk environment(s) EN ISO/IEC 27006 specifies requirements and provides guidance for bodies providing audit Requirements for bodies providing and certification of an information security audit and certification of management system (ISMS), in addition to the EN ISO/IEC 27006:2020 Standard Requirements CEN-CLC information security management requirements contained within ISO/IEC 17021-1 systems and EN ISO/IEC 27001. It is primarily intended to support the accreditation of certification bodies providing ISMS certification.

text: RISK MANAGEMENT STANDARDS

text: The present document specifies a methodology for the assessment of conformance for consumer IoT devices, their relation to associated services and corresponding relevant Cyber Security for Consumer processes against ETSI TS 103 645 [1] or ETSI EN Internet of Things: TS 103 701 Other Evaluation Methodology ETSI 303 645 [2], addressing the mandatory and Conformance Assessment of recommended provisions as well as the Baseline Requirements conditions and complements of ETSI TS 103 645 [1]or ETSI EN 303 645 [2] by defining test cases and assessment criteria for each provision. The current document defines a method CYBER; Methods and protocols; Part primarily for use by developers of ETSI 1: Method and pro forma for Technical standards in undertaking an analysis of the ETSI TS 102 165-1 Technical specification ETSI Threat, Vulnerability and Risk Specification threats, risks and vulnerabilities of an Analysis (TVRA). information and communications technology (ICT) system Telecommunications and Internet converged Services and Protocols The present document presents the results of for Advanced Networking (TISPAN); ETSI TR 187 002 Technical Report Technical report ETSI the threat vulnerability risk analysis (TVRA) for TISPAN NGN Security (NGN_SEC); the NGN. Threat, Vulnerability and Risk Analysis The Risk Management Framework provides a process that integrates security, privacy, and cyber supply chain risk management activities Risk Management Framework for into the system’s development life cycle. The Information Systems and SP 800-37 Rev.2 Guide/Guidance Guidance NIST risk-based approach to control selection and Organizations: A System Life Cycle specification considers effectiveness, efficiency, Approach for Security and Privacy and constraints due to applicable laws, directives, executive orders, policies, standards or regulations. The purpose of Special Publication 800-39 is to provide guidance for an integrated, organisation-wide programme for managing Managing Information Security Risk: information security risk to organisational Organisation, Mission, and SP 800-39 Guide/Guidance Guidelines NIST operations (i.e. mission, functions, image, and Information System View reputation), organisational assets, individuals, other organisations and the nation resulting from the operation and use of federal information systems.

text: RISK MANAGEMENT STANDARDS

text: The purpose of this publication is to provide guidance to federal agencies on identifying, Supply Chain Risk Management assessing, selecting and implementing risk Practices for Federal Information SP 800-161 Guide/Guidance Guidelines NIST management processes and mitigating controls Systems and Organisations throughout their organisations to help manage ICT supply chain risks. This document provides the ever-increasing Key Practices in Cyber Supply Chain community of digital businesses a set of key Risk Management: Observations NISTIR 8276 Other Best practices NIST practices that any organisation can use to from Industry manage cybersecurity risks associated with their supply chains. This document is intended to help individual organisations within an enterprise improve their cybersecurity risk information, which they provide as inputs to their enterprise’s ERM Integrating Cybersecurity and processes through communications and risk NISTIR 8286 Guide/Guidance Guidelines NIST Enterprise Risk Management (ERM) information sharing. By doing so, enterprises and their component organisations can better identify, assess and manage their cybersecurity risks in the context of their broader mission and business objectives. The methodology demonstrates how the threats Risk analysis based on IT- listed in the IT-Grundschutz catalogues can be BSI-Standard 100-3 Other Methodology BSI (Germany) Grundschutz used to carry out a simplified analysis of risks for information processing. The IT-Grundschutz Methodology is a BSI methodology for effective management of the information security that can be easily adapted to the situation of a specific organisation. This method provides both a methodology for IT-Grundschutz Methodology BSI-Standard 100-2 Other Methodology BSI (Germany) setting up a management system for information security and a comprehensive basis for assessing risks, monitoring the existing security level, and implementing the appropriate information safeguards.

text: RISK MANAGEMENT STANDARDS

text: To defend against threat actors and their tactics, organisations need to identify, create, document, and test detection, investigation, prevention, mitigation and remediation steps. These steps, when grouped together form a cyber security playbook that can be used to protect organisational systems, networks, data and users. This specification defines the schema and CACAO Security Playbooks Version CACAO-Security- taxonomy for collaborative automated courses Other Methodology OASIS 1.0 Playbooks-v1.0 of action for operations (CACAO) and security playbooks and how these playbooks can be created, documented and shared in a structured and standardised way across organisational boundaries and technological solutions. It defines the following classes of objects: playbooks (section 4), workflow steps (section 5), commands (section 6), targets (section 7), extensions (section 8), and data markings (section 9). A standard language supporting creation, update, and interoperable exchange of security advisories as structured information on products, vulnerabilities and the status of impact and remediation among interested parties. The term Security Advisory is used to describe any notification of security issues in products of and by providers. The focus is on the security aspect impacting (or CSAF Common Vulnerability not impacting) specific combinations of guidelines, methodology, Reporting Framework (CVRF) CVRF-v1.2 Other OASIS products, platforms, and versions. Information data specification Version 1.2. on the presence or absence of work-arounds is also considered part of the security issue. It addresses security advisories from anyone providing a product, i.e. developers or maintainers of information system products or services. This includes all authoritative product vendors, product security incident response teams (PSIRTs), and product resellers and distributors, including authoritative vendor partners.

text: RISK MANAGEMENT STANDARDS

text: A concise and extensible language to enable machine-to-machine communications for purposes of the command and control of cyber defence components, subsystems and/or systems in a manner that is agnostic of the underlying products, technologies and transport mechanisms. OpenC2 is a suite of specifications that enables command and control of cyber defence systems Open Command and Control Methodology, data and components, typically using a request- (OpenC2) Language Specification OpenC2-Lang-v1.0 Other OASIS specification response paradigm. OpenC2 allows the Version 1.0 application producing the commands to discover the set of capabilities supported by the managed devices. These capabilities permit the managing application to adjust its behaviour to take advantage of the features exposed by the managed device. The capability definitions can be easily extended in a non-centralised manner, allowing standard and non-standard capabilities to be defined with semantic and syntactic rigor. Open Command and Control (OpenC2) is a concise, extensible language enabling command and control of cyber defence components. Stateless packet filtering is a cyber defence mechanism that denies or allows traffic based on static properties of the traffic, such as address, port, protocol, etc. This profile defines Open Command and Control the actions, targets, specifiers and options that (OpenC2) Profile for Stateless OpenC2-SLPF-v1.0 Other Methodology OASIS are consistent with version 1.0 of the OpenC2 Packet Filtering Version 1.0 Language Specification in the context of stateless packet filtering (SLPF). An actuator profile for OpenC2 that specifies the set of actions, targets, specifiers and command arguments integrates SLPF functionality with the Open Command and Control (OpenC2) Command set. Open Command and Control (OpenC2) is a concise, extensible language enabling command Specification for Transfer of OpenC2 and control of cyber defence components. OpenC2-HTTPS-v1.0 Other Methodology OASIS Messages via HTTPS Version 1.0 Stateless packet filtering is a cyber defence mechanism that denies or allows traffic based on static properties of the traffic, such as

text: RISK MANAGEMENT STANDARDS

text: address, port, protocol, etc. This document specifies the use of hypertext transfer protocol (HTTP) over transport layer security (TLS) as a transfer mechanism for OpenC2 messages. The specification provides guidance to the OpenC2 implementation community when using HTTPS for OpenC2 message transport. It includes guidance for the selection of TLS versions and options suitable for use with OpenC2. SARIF is included because of its potential relevance to risk assessment. Software developers use a variety of analysis tools to assess program qualities such as correctness, security, vulnerability, performance, compliance with contractual or legal requirements, etc. SARIF defines a standard format for the output Static Analysis Results Interchange Methodology, data of static analysis tools to enable aggregation, SARIF-v2.1.0 Other OASIS Format (SARIF) Version 2.1 specification analysis, and sharing of results. The standard defines a format for the output of static analysis tools, in order to capture the range of data produced by commonly used static analysis tools, enable data interchange, reduce cost and complexity, and capture information useful for assessing a project’s compliance with corporate policy or certification standards. A language and serialisation format used to exchange cyber threat intelligence (CTI), STIX enables CTI-sharing in a consistent and machinereadable manner, allowing security communities to better understand what Methodology, data computer-based attacks they are most likely to STIX Version 2.1 STIX-v2.1 Other OASIS specification see and to anticipate and/or respond to those attacks faster and more effectively. STIX is designed to improve many different capabilities, such as collaborative threat analysis, automated threat exchange, automated detection and response, and more.

text: RISK MANAGEMENT STANDARDS

text: TAXII is an application layer protocol for the communication of cyber threat information in a simple and scalable manner. This specification defines the TAXII RESTful API and its resources along with the requirements for TAXII client and server implementations. Trusted Automated eXchange of Indicator Information (TAXII™) defines a set of services and message exchanges that, when implemented, enable sharing of actionable TAXII Version 2.1 TAXII-v1.1.1-Overview Other Methodology OASIS cyber threat information across the organisation and product or service boundaries. TAXII, through its member specifications, defines concepts, protocols and messages to exchange cyber threat information for the detection, prevention, and mitigation of cyber threats. TAXII is not an information sharing initiative or application and does not attempt to define trust agreements, governance, or non-technical aspects of cyber threat information sharing. The Framework defines the essential COSO Committee components of enterprise risk management, of Sponsoring Enterprise Risk Management — discusses key ERM principles and concepts, COSO ERM Guide/Guidance Guidance Organisations of Integrated Framework suggests a common ERM language, and provides the Treadway clear direction and guidance for enterprise risk Commission management. This document provides information on how to Systems and software engineering design, develop, implement, and continually ISO/IEC/IEEE — Life cycle processes — Risk Guide/Guidance Guidelines Other improve risk management in a systems and 16085:2021 management software engineering project throughout its life cycle. Providing principles and generic guidelines on risk management, this standard can be used by any public, private or community enterprise, association, group or individual, and is not specific to any industry or sector. It can be Risk management - Principles and AS/NZS ISO 31000:2009 Standard Risk management Other applied throughout the life of an organisation, guidelines and to a wide range of activities, including strategies and decisions, operations, processes, functions, projects, products, services and assets. Although the standard provides generic guidelines, it is not intended to promote

text: RISK MANAGEMENT STANDARDS

text: uniformity of risk management across organisations. The design and implementation of risk management plans and frameworks will need to take into account the varying needs of a specific organisation, its particular objectives, context, structure, operations, processes, functions, projects, products, services or assets and specific practices employed. This document strives to define a set of engineering measures that will guide an Security for industrial automation organisation through the process of assessing and control systems–Part 3-2: ISA/IEC 62443-3-2 Standard Techniques Other the risk of a particular industrial automation Security risk assessment for system and control system (IACS) and enable it to design identify and apply security countermeasures to reduce that risk to tolerable levels. The OWASP Risk Assessment Framework OWASP Risk Risk Assessment consists of static application security testing and OWASP Risk Rating Methodology Other OWASP Assessment Framework Framework risk assessment testers able to analyse and review their code quality and vulnerabilities.

text: RISK MANAGEMENT STANDARDS

text: ANNEX B: ANALYSIS OF EIDAS REGULATION

text: We present below an example of how ICT risk and risk management are treated by analysing the existing eIDAS regulation (Electronic Identification and Trust Services for Electronic Transactions -

text: Regulation (EU) No 910/2014

text: eIDAS items Electronic Identification and Trust Services for Electronic Means Transactions -

text: Regulation (EU) No 910/2014

text: Recital (20): cooperation by Member States should facilitate the Risk

text: Identification

text: technical interoperability of the notified electronic identification management

text: schemes – Mutual

text: schemes with a view to fostering a high level of trust and security performed by recognition appropriate to the degree of risk. The exchange of information and peer reviews the sharing of best practices between Member States with a view to their mutual recognition should help such cooperation.

text: Recital (32): it should be incumbent on all trust service providers to Trust Service Apply good apply good security practice appropriate to the risks related to their Providers security activities so as to boost users’ trust in the single market. practices

text: Recital (36): ‘electronic registered delivery service’ means a service Data protection Management that makes it possible to transmit data between third parties by handle by of the risk of electronic means and provides evidence relating to the handling of the electronic data transmitted, including proof of sending and receiving the data, and loss, theft, registered that protects transmitted data against the risk of loss, theft, damage damage, or delivery service or any unauthorised alterations. unauthorised alterations

text: Recital (37): this regulation should provide for the liability of all trust Liability of all Insurance service providers. In particular, it establishes the liability regime under trust service policies, set which all trust service providers should be liable for damage caused to providers – any natural or legal person due to failure to comply with the obligations of limitations assessment of under this regulation. In order to facilitate the assessment of financial of liability in financial risk risk that trust service providers might have to bear or that they should their terms of cover by insurance policies, this regulation allows trust service uses of the providers to set limitations, under certain conditions, on the use of the service services they provide and not to be liable for damages arising from the use of services exceeding such limitations. Customers should be duly informed about the limitations in advance. Those limitations should be recognisable by a third party, for example by including information about the limitations in the terms and conditions of the service provided or through other recognisable means. For the purposes of giving effect to those principles, this regulation should be applied in accordance with national rules on liability. Therefore, this regulation does not affect national rules on, for example, definition of damages, intention, negligence or relevant applicable procedural rules.

text: Recital (38): notification of security breaches and security risk Security risk assessments is essential with a view to providing adequate information assessments and to concerned parties in the event of a breach of security or loss of notification of integrity. security breaches

text: Article 8.2

text: (a): assurance level low shall refer to a means of electronic identification in the context of an electronic identification scheme, which

text: RISK MANAGEMENT STANDARDS

text: provides a limited degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of misuse or alteration of the identity;

text: Article 8.2

text: (b): assurance level substantial shall refer to a means of electronic identification in the context of an electronic identification scheme, which provides a substantial degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of misuse or alteration of the identity;

text: Article 12

text: . 7: By 18 March 2015, the Commission shall, by means of implementing acts, establish the necessary procedural arrangements to facilitate cooperation between the Member States referred to in paragraphs 5 and 6 with a view to fostering a high level of trust and security appropriate to the degree of risk.

text: Article 19

text: Security requirements applicable to trust service providers

text: 1. Qualified and non-qualified trust service providers shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust services they provide. Having regard to the latest technological developments, those measures shall ensure that the level of security is commensurate to the degree of risk. In particular, measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of the adverse effects of any such incidents.

text: Article 24.2

text: C) on:

text: Requirements for qualified trust service providers

text: 2. A qualified trust service provider providing qualified trust services shall:

text: (c) with regard to the risk of liability for damages in accordance with

text: Article 13

text: , maintain sufficient financial resources and/or obtain appropriate liability insurance, in accordance with national law.

text: -N -EN

text: -099 -22 -07 TP

text: ABOUT ENISA

text: 978-92-9204-569-2 10.2824/001991