1. Purpose
Establish the comprehensive set of structural elements that govern how [ORGANIZATION] identifies, assesses, manages, and monitors cyber risk, providing the operational foundation for implementing the Cyber Risk Strategy.
2. Scope
This framework applies to all cyber risk management activities conducted by or on behalf of [ORGANIZATION], encompassing all personnel, processes, technology, and third-party relationships that create, manage, or mitigate cyber risk.
3. Framework Content
3.1 Framework Overview
This Cyber Risk Framework operationalizes [ORGANIZATION]'s Cyber Risk Strategy by defining the policies, standards, roles and responsibilities, risk management processes, risk taxonomy, and risk appetite that collectively govern cyber risk management.
The framework is structured around [CUSTOMIZE: e.g., NIST CSF 2.0 / ISO 27001 / COBIT] as the primary reference framework, supplemented by industry-specific requirements including [CUSTOMIZE: applicable regulations/standards].
All components of this framework are subject to the governance and review processes defined in Section 8.
3.2 Framework Components
The Cyber Risk Framework consists of the following interrelated components:
Policies: The complete set of cyber risk policies that define organizational expectations and requirements. The current policy inventory is maintained at [CUSTOMIZE: location/system].
Standards: Technical and procedural standards that specify how policy requirements are implemented. Standards are maintained by [CUSTOMIZE: role/team].
Procedures: Step-by-step operational procedures that ensure consistent execution of standards. Procedures are owned by operational teams within the first line of defence.
Roles and Responsibilities: Defined using the three lines of defence model as documented in Section 4 of this framework.
Risk Management Processes: The processes for identifying, assessing, treating, monitoring, and reporting cyber risk as defined in Section 5.
Risk Taxonomy: The standardized categorization of cyber risks as defined in Section 6.
Risk Appetite: The organization's tolerance for cyber risk as defined in the Risk Appetite Statement (Appendix A).
3.3 Policy Architecture
[ORGANIZATION]'s cyber risk policy architecture follows a tiered structure:
Tier 1 - Cyber Risk Policy: The overarching policy approved by [CUSTOMIZE: Board/Executive] that establishes the mandate for cyber risk management.
Tier 2 - Domain Policies: Policies addressing specific domains including but not limited to: acceptable use, access control, data protection, incident response, third-party risk management, and business continuity.
Tier 3 - Standards and Guidelines: Technical and procedural standards that specify implementation requirements for each domain policy.
Tier 4 - Procedures and Playbooks: Detailed operational procedures maintained by control owners.
The complete policy inventory, including ownership, review dates, and approval status, is maintained in [CUSTOMIZE: GRC tool/document management system].
3.4 Roles and Responsibilities - Three Lines of Defence
First Line of Defence (Risk Ownership): Business units and IT operations are responsible for identifying and managing cyber risks within their areas of responsibility, implementing controls, conducting self-assessments, and reporting on control effectiveness. First-line roles include: [CUSTOMIZE: e.g., Business Unit Managers, IT Operations, Application Owners, Data Owners].
Second Line of Defence (Risk Oversight): The [CUSTOMIZE: Cyber Risk Management / Enterprise Risk Management / Compliance] function provides independent oversight, sets standards, conducts independent risk assessments, challenges first-line activities, and reports on the organization's overall cyber risk posture. Second-line roles include: [CUSTOMIZE: e.g., CISO, Cyber Risk Managers, Compliance Officers].
Third Line of Defence (Independent Assurance): Internal Audit provides independent assurance on the effectiveness of both first and second line activities. The Internal Audit charter includes cyber risk within its scope and mandate.
Board and Executive Oversight: The [CUSTOMIZE: Board Risk Committee / Audit Committee] provides governance oversight of the cyber risk framework. The [CUSTOMIZE: Executive Risk Committee] provides executive-level direction and resource allocation.
3.5 Risk Management Processes
Risk Identification: Cyber risks are identified through threat intelligence monitoring, vulnerability assessments, control gap analyses, incident reviews, third-party assessments, and business change impact assessments. All identified risks are recorded in the Cyber Risk Register maintained in [CUSTOMIZE: GRC tool/system].
Risk Assessment: Risks are assessed using a [CUSTOMIZE: qualitative/semi-quantitative/quantitative] methodology that evaluates likelihood and impact across [CUSTOMIZE: confidentiality, integrity, availability, financial, regulatory, and reputational] dimensions. Assessment criteria are defined in the Risk Assessment Methodology (Appendix B).
Risk Treatment: For each assessed risk, one of four treatment options is selected: Mitigate (implement controls to reduce risk), Transfer (share risk through insurance or contractual arrangements), Accept (formally accept within risk appetite), or Avoid (discontinue the activity creating the risk). Treatment decisions must be authorized per the Risk Acceptance Authority Matrix (Appendix C).
Risk Monitoring: Risks are monitored through Key Risk Indicators (KRIs), control testing, incident analysis, and periodic reassessment. The monitoring cadence is defined per risk level: Critical risks are monitored [CUSTOMIZE: continuously/monthly], High risks [CUSTOMIZE: monthly/quarterly], and Medium/Low risks [CUSTOMIZE: quarterly/semi-annually].
Risk Reporting: The [CUSTOMIZE: CISO/CRO] provides risk reports to [CUSTOMIZE: Executive Risk Committee] at least [CUSTOMIZE: monthly/quarterly] and to the [CUSTOMIZE: Board Risk Committee] at least [CUSTOMIZE: quarterly]. Reports include current risk posture, trending, threshold breaches, and treatment progress.
3.6 Risk Taxonomy
[ORGANIZATION] uses the following standardized cyber risk taxonomy to ensure consistent categorization and communication of risks:
Category 1 - External Threats: Malware, phishing, ransomware, DDoS, advanced persistent threats, supply chain compromise, zero-day exploits.
Category 2 - Insider Threats: Malicious insiders, negligent insiders, compromised credentials, privilege abuse.
Category 3 - Technology Risks: Misconfigurations, unpatched vulnerabilities, legacy systems, inadequate architecture, cloud-specific risks.
Category 4 - Third-Party Risks: Vendor breaches, service provider failures, supply chain integrity, concentration risk.
Category 5 - Compliance Risks: Regulatory non-compliance, contractual non-compliance, policy violations.
Category 6 - Data Risks: Data breaches, data loss, data integrity compromise, privacy violations.
Category 7 - Operational Risks: Service disruptions, disaster recovery failures, capacity constraints, change management failures.
[CUSTOMIZE: Add or modify categories to align with the organization's enterprise risk taxonomy]
3.7 Emerging Threats and Technologies
The framework incorporates a process for monitoring and assessing the risk implications of emerging threats and technologies including but not limited to:
Artificial intelligence and machine learning (adversarial AI, deepfakes, AI-assisted attacks)
Quantum computing implications for cryptographic controls
IoT and operational technology convergence risks
Cloud-native architectures and serverless computing risks
The [CUSTOMIZE: Cyber Threat Intelligence / Security Architecture] team maintains an Emerging Risk Watch List, reviewed [CUSTOMIZE: quarterly] by the [CUSTOMIZE: CISO / Security Leadership Team], with findings incorporated into the risk register and framework updates as warranted.
3.8 Framework Governance and Review
This framework shall be reviewed comprehensively at least [CUSTOMIZE: annually] by [CUSTOMIZE: CISO/Cyber Risk Team] with approval from [CUSTOMIZE: Executive Risk Committee].
Interim updates may be triggered by significant regulatory changes, material incidents, organizational restructuring, or significant changes to the threat landscape.
All framework components (policies, standards, procedures) follow the review schedule defined in the Policy Governance Standard.
Framework effectiveness is measured through the following indicators: [CUSTOMIZE: e.g., maturity assessment scores, audit findings, incident metrics, risk assessment completion rates].
4. Compliance
Compliance with this framework is mandatory for all personnel and functions within its scope. Compliance will be monitored through periodic audits, management review, and second line of defence oversight.
Exceptions to this framework must be documented with a business justification, approved by [CUSTOMIZE: CISO/Executive Risk Committee], and reviewed at least annually.
5. Review and Revision
This framework shall be reviewed at least annually by [CUSTOMIZE: CISO/Document Owner] and updated as necessary to reflect changes in the threat landscape, regulatory requirements, organizational structure, or risk appetite.
All revisions shall be documented with version number, date, author, and description of changes.
Document Approval
Approved By
Title
Date
Document Control