Cyber Risk Reporting and Escalation Procedure
Governance Control: Risk Review and Executive Escalation
1. Purpose
Define the process for regularly reviewing, prioritizing, and escalating cyber risks to ensure that executives and senior management have timely, actionable visibility into the organization's cyber risk posture and can make informed risk treatment decisions.
2. Scope
This procedure applies to all cyber risk reporting from operational teams through executive governance, covering the full lifecycle of risk identification, prioritization, escalation, and treatment tracking.
3. Procedure Content
3.1 Risk Review Cadence
Operational Risk Reviews: [CUSTOMIZE: Weekly] reviews conducted by [CUSTOMIZE: Security Operations / IT Operations] to assess new risks, update existing risk ratings, and review treatment progress.
Management Risk Reviews: [CUSTOMIZE: Monthly] reviews conducted by [CUSTOMIZE: CISO / Cyber Risk Team] to consolidate operational inputs, assess risk trends, and prepare management reporting.
Executive Risk Reviews: [CUSTOMIZE: Quarterly] reviews conducted with [CUSTOMIZE: Executive Risk Committee] to review the enterprise cyber risk posture, approve treatment decisions, and allocate resources.
Board Risk Reviews: [CUSTOMIZE: Quarterly] briefings to the [CUSTOMIZE: Board Risk Committee] on cyber risk posture, significant developments, and strategic risk considerations.
Ad Hoc Reviews: Triggered by significant incidents, threat intelligence indicating imminent risk, or material changes to the risk environment.
3.2 Risk Prioritization Methodology
Risks shall be prioritized using the following criteria evaluated in combination:
Residual Risk Level: Based on the risk assessment methodology (likelihood x impact after controls), risks rated Critical or High receive priority attention.
Velocity: Risks with rapid onset potential (could materialize within [CUSTOMIZE: 30 days]) are escalated regardless of overall risk level.
Business Impact: Risks affecting [CUSTOMIZE: customer-facing services, regulatory compliance, financial operations] receive elevated priority.
Trend Direction: Risks with deteriorating trends (increasing likelihood or impact) over [CUSTOMIZE: two or more] reporting periods are flagged for enhanced attention.
Aggregation: Related risks that individually appear moderate but collectively represent material exposure are identified and reported as aggregated risk.
3.3 Escalation Criteria and Pathways
The following escalation criteria apply:
| Condition | Escalation To | Timeframe | Required Actions |
|---|---|---|---|
| New Critical risk identified | [CUSTOMIZE: CISO] | Within 4 hours | Initial assessment, containment options |
| KRI enters Red threshold | [CUSTOMIZE: CISO] | Within 24 hours | Root cause analysis, action plan |
| Risk exceeds appetite for 2+ periods | [CUSTOMIZE: Exec Risk Committee] | Next scheduled meeting or ad hoc | Treatment plan with timeline |
| Material risk to customer data | [CUSTOMIZE: CEO / Board] | Within 24 hours | Incident assessment, regulatory notification plan |
| Regulatory finding unresolved past deadline | [CUSTOMIZE: Exec Risk Committee] | Within 5 business days of deadline | Remediation acceleration plan |
| Aggregate risk concentration identified | [CUSTOMIZE: CISO] | Within 5 business days | Concentration analysis, treatment options |
3.4 Executive Risk Report Template
Executive risk reports shall include the following standard sections:
1. Risk Posture Summary: Overall risk status (GREEN/AMBER/RED), change from prior period, and key drivers of change.
2. Top Risks: The [CUSTOMIZE: top 10] cyber risks ranked by priority with current ratings, trend indicators, and treatment status.
3. KRI/KPI Dashboard: Current values against thresholds with trend indicators.
4. Incident Summary: Count and classification of incidents in the reporting period with notable incidents detailed.
5. Compliance Status: Summary of regulatory compliance posture with open findings and remediation progress.
6. Treatment Progress: Status of approved risk treatment initiatives against planned milestones.
7. Emerging Risks: New or evolving risks identified during the period that may require strategic attention.
8. Resource and Budget Status: Cyber risk program resource utilization and budget status.
9. Decisions Required: Specific risk treatment decisions or resource allocation requests for executive action.
3.5 Treatment Decision Tracking
All risk treatment decisions made by governance bodies shall be documented in the [CUSTOMIZE: GRC tool/risk register] within [CUSTOMIZE: 5 business days] of the decision.
Each decision record shall include: risk ID, decision date, decision maker, treatment option selected, assigned owner, target completion date, and any conditions or compensating controls.
Treatment progress shall be reported at each subsequent governance meeting until the treatment is complete and validated.
Treatments that fall behind schedule by more than [CUSTOMIZE: 30 days] shall be automatically escalated to the next governance level.
4. Compliance
Compliance with this procedure is mandatory for all personnel and functions within its scope. Compliance will be monitored through periodic audits, management review, and second line of defence oversight.
Exceptions to this procedure must be documented with a business justification, approved by [CUSTOMIZE: CISO/Executive Risk Committee], and reviewed at least annually.
5. Review and Revision
This procedure shall be reviewed at least annually by [CUSTOMIZE: CISO/Document Owner] and updated as necessary to reflect changes in the threat landscape, regulatory requirements, organizational structure, or risk appetite.
All revisions shall be documented with version number, date, author, and description of changes.
Document Approval
Approved By
Title
Date
Document Control