Twelve questions that come up on the way to a working program, with practitioner-level answers.
What is cyber and IT risk management?+
Cyber and IT risk management is the discipline of identifying, assessing, treating, and monitoring the risks created by an organization's use of information systems, data, and digital infrastructure. It blends information security risk (the focus of ISO 27005 and NIST 800-30) with broader IT operational risk (availability, change, resilience), and feeds the wider enterprise risk management program defined by ISO 31000 or COSO ERM. The deliverable is a current view of exposure relative to risk appetite, and a set of decisions about what to do about it.
What is the difference between cyber risk and IT risk?+
Cyber risk is a subset of IT risk that focuses specifically on threats from adversaries (ransomware, phishing, exploitation) and the confidentiality, integrity, and availability of information. IT risk is the broader category, it also includes change-management failures, capacity issues, outages, vendor failures, and technology obsolescence. A useful frame: every cyber risk is an IT risk, but not every IT risk is a cyber risk. Mature programs run them on one platform because the controls, owners, and audiences overlap heavily.
Which framework should I use, NIST or ISO?+
If you sell to or operate in regulated US federal markets, NIST (CSF 2.0 for the program outcomes, 800-30 for assessments, 800-53 for the control catalog) is the path of least resistance. If you operate internationally or want certification, the ISO family (27001 for the management system, 27005 for risk methodology, 31000 for the enterprise frame) is the de facto choice. The two are heavily cross-mappable, you do not need to pick one forever. Many programs run NIST CSF for the executive narrative and ISO 27001 for the certification, with ISO 27005 or NIST 800-30 underneath as the assessment methodology.
What is the difference between qualitative and quantitative risk assessment?+
Qualitative assessment scores risks on ordinal scales (Low, Medium, High, or 1 through 5) for likelihood and impact, then plots them on a heat map. It is fast, easy to socialize, and good enough for most risks. Quantitative assessment expresses risk in dollar terms, usually via FAIR or a Monte Carlo simulation: loss event frequency multiplied by loss magnitude, with distributions, produces an annualized loss expectancy and a loss-exceedance curve. Quantitative is the right answer for top-N risks where the cost of being wrong is high and you need to compare cyber spend against other investments. Most programs run qualitative across the whole register and reserve quantitative for the top 10 to 20 risks.
What goes into a cyber risk register?+
At minimum: a unique risk ID, a one-sentence risk statement (threat plus vulnerability plus impact), the affected asset or process, the owner, the inherent score, the controls in place, the residual score, the treatment decision (mitigate, transfer, avoid, accept), the target score, the next review date, and a status. Mature registers add: linked compliance question categories, linked KRIs, related incidents, audit findings that influence the score, and a timestamped audit trail of changes. The register is the source of truth, every dashboard and board report should reconcile to it.
What are KRIs and how are they different from KPIs?+
Key Risk Indicators (KRIs) are leading metrics that signal rising risk before it materializes, for example phishing-simulation failure rate or mean time to remediate critical vulnerabilities. Key Performance Indicators (KPIs) measure whether the program itself is operating as designed, for example percentage of assessments completed on time. KRIs answer 'is exposure increasing?' KPIs answer 'is the team delivering?' Both belong on the dashboard, but only KRIs should be wired to automatic escalation when thresholds break.
How often should a risk assessment be run?+
Continuous in concept, scheduled in practice. Run a full enterprise-wide cyber risk assessment annually. Run targeted reassessments quarterly for the top quartile of risks. Trigger ad-hoc reassessments on material events: a new system going live, a significant vendor onboarded, a regulatory change, a breach in the sector, an incident that revealed a control gap. Modern programs supplement this with continuous monitoring (KRIs, control tests, compliance assessment results) so the residual score on any risk updates as evidence arrives, rather than waiting for the next assessment cycle.
What is risk appetite and how do I set it?+
Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives. Set it once, at the board or executive level, in qualitative statements per risk category (for example, 'we have low appetite for regulatory non-compliance, moderate appetite for operational disruption, high appetite for innovation-related execution risk'). Translate the qualitative statements into quantitative thresholds where you can: maximum acceptable residual score per risk category, maximum annualized loss expectancy on cyber risks, downtime tolerance per critical system. The appetite then becomes the line on every heat map and the trigger for every escalation.
How does compliance fit into cyber risk management?+
Compliance frameworks (ISO 27001, HIPAA, PCI DSS, SOC 2, NIST 800-53, GDPR) are the externally imposed control sets that an organization must demonstrate. Risk management decides which additional controls are needed beyond compliance, and where compliance controls are operating effectively enough to reduce residual risk. The bridge is a control library that maps each control to both the compliance requirements it satisfies and the risks it mitigates. When a compliance assessment finds a control gap, the residual score on the mapped risk should update automatically, that is how risk and compliance stay in sync.
How does software help with cyber and IT risk management?+
Software replaces the spreadsheet sprawl that breaks the moment a third framework or a second business unit joins the program. A modern platform centralizes the register, the control library, KRIs, and treatment workflows; runs assessments against any framework; cross-maps controls to compliance requirements; and feeds compliance evidence back into risk scores. The practical wins are auditability (a timestamped trail of every change), consistency (the same scoring methodology across teams), and speed to board (the rollup builds itself rather than being assembled the night before). RiskWatch supports this pattern via the Global Register, KRI Library, Risk Templates, and Risk-vs-Compliance mapping.
What is the difference between inherent, residual, and target risk?+
Inherent risk is the risk before controls are considered, raw exposure given the threat and the asset value. Residual risk is the risk that remains after the controls currently in place are credited. Target risk is the level you want to reach after the planned treatment is implemented; the gap between residual and target is the work the program owes. Tracking all three creates the story for the board: here is what we faced (inherent), here is what we have reduced it to (residual), and here is where we are taking it (target). Treatment plans should always specify a target.
Where should a small team start?+
Start with the register, not the framework. Pick a single template (ISO 27005 is a good first choice), enumerate your top 20 to 40 risks, score them qualitatively, and assign owners. Run the first formal review at 30 days. Once that cadence works, layer in: a control library you can map to risks, a small set of KRIs (start with five), and one external framework crosswalk (NIST CSF 2.0 gives the best board narrative). Resist building the perfect taxonomy before you have a working register. The program grows by accretion; the worst pattern is a six-month design phase that produces no register at all.
