Cyber Risk Management, Governance and Compliance

Introduction

Cybersecurity is not only a technical activity. It is a management discipline concerned with protecting information, technology, people, and business processes from events that may harm an organisation. Firewalls, encryption, authentication, and monitoring are valuable controls, but they must be selected and governed according to risk. An organisation cannot eliminate every threat; it must decide which risks are acceptable, which require treatment, and how those decisions will be reviewed.

Cyber risk management provides a structured method for making these decisions. Governance establishes authority, accountability, and direction. Compliance ensures that legal, contractual, regulatory, and internal obligations are understood and met. Together, these activities help an organisation protect confidentiality, integrity, and availability while supporting its strategic objectives.

Learning Objectives

By the end of this chapter, you should be able to:

• identify and classify information, technology, people, and process assets;
• distinguish threats, vulnerabilities, risks, controls, and incidents;
• perform basic likelihood and impact assessments;
• document risks in a risk register and select treatment options;
• explain cybersecurity governance roles and policy structures;
• distinguish assurance, audit, compliance, and certification;
• describe the purposes of the NIST Cybersecurity Framework, ISO/IEC 27001, and CIS Controls;
• recognise important legal, privacy, contractual, and regulatory obligations.

1. The Foundations of Cyber Risk

Assets, threats, vulnerabilities, and consequences

An asset is anything that has value to an organisation and therefore requires protection. Assets include databases, applications, networks, cloud services, laptops, facilities, intellectual property, employees, suppliers, and reputation. An asset may be tangible or intangible.

A threat is a potential cause of harm. Threats may be deliberate, such as ransomware, fraud, espionage, or sabotage; accidental, such as misdelivery of confidential information; or environmental, such as fire, flooding, or power failure.

A vulnerability is a weakness that a threat can exploit. Examples include unpatched software, excessive privileges, weak passwords, poor physical security, inadequate backup testing, or unclear supplier responsibilities. A vulnerability does not automatically create a loss; it creates a condition in which a threat may succeed.

A risk is the possibility that a threat will exploit a vulnerability and produce an adverse consequence. Risk is therefore connected to uncertainty, not merely to the existence of a weakness. A vulnerability scan may identify an outdated server, but risk assessment must determine what the server supports, who could exploit it, how likely exploitation is, and what harm could result.

The principal security objectives are:

• Confidentiality: information is accessible only to authorised parties.
• Integrity: information and systems remain accurate, complete, and trustworthy.
• Availability: authorised users can access systems and information when needed.

Modern assessments may also consider authenticity, accountability, safety, privacy, resilience, and non-repudiation.

Risk appetite and risk tolerance

Risk appetite is the broad amount and type of risk an organisation is willing to pursue or retain in support of its objectives. A hospital may have very low appetite for risks affecting patient safety, while accepting some availability risk for a low-value public information site. Risk tolerance describes acceptable variation around a particular objective or risk decision. These concepts should be approved by senior leadership rather than inferred solely by technical staff.

2. Conducting a Basic Risk Assessment

Risk assessment is a systematic process of identifying risks, analysing their likelihood and impact, and evaluating whether they require treatment. A practical assessment normally follows these steps:

1. establish scope, context, and assessment criteria;
2. identify important assets and their owners;
3. identify relevant threats and vulnerabilities;
4. estimate likelihood and impact;
5. determine the risk rating;
6. compare the result with risk criteria;
7. record the result and proposed treatment;
8. communicate findings and obtain approval.

Asset assessment

Asset inventories should record ownership, location, business purpose, classification, dependencies, and recovery requirements. A useful classification scheme might include public, internal, confidential, and highly restricted. Classification should be based on the consequences of unauthorised disclosure, alteration, or loss.

Asset owners are accountable for deciding how an asset is used and protected. A system administrator may operate a server, but the business owner decides the importance of the service and approves acceptable use.

Likelihood and impact

Likelihood estimates how probable a risk event is within a stated period and context. Impact estimates the consequences if the event occurs. Impact can include financial loss, legal penalties, regulatory action, operational interruption, safety consequences, privacy harm, and reputational damage.

A common qualitative method uses a five-point scale. For example, likelihood may range from 1 (rare) to 5 (almost certain), and impact from 1 (minor) to 5 (severe). A simple risk score can be calculated as:

Here, R is the risk score, L is the likelihood rating, and I is the impact rating. The values are ordinal ratings, not physical measurements; therefore, the multiplication provides a prioritisation aid rather than a precise probability of loss. The organisation must define score bands, such as low, medium, high, and critical, before using the method.

For example, suppose a payroll database has a likelihood rating of 3 and an impact rating of 5. Then:

If the organisation defines 12–25 as high risk, the risk should receive timely treatment. This calculation does not prove that a loss has a 15-unit probability. It simply applies the approved scoring convention consistently.

Quantitative assessment may instead estimate annual loss. A simplified annualised loss expectancy model is:

where SLE is single loss expectancy, the estimated loss from one occurrence, and ARO is annual rate of occurrence, the expected number of occurrences per year. This model assumes that the estimates are meaningful and that the organisation can reasonably approximate frequency and loss. It should not be used to create false precision when reliable data are unavailable.

Inherent and residual risk

Inherent risk is the level of risk before considering controls. Residual risk is the risk remaining after controls are implemented and operating. A control may reduce likelihood, impact, or both. Residual risk must be compared with the organisation’s risk appetite and formally accepted where appropriate.

3. The Risk Register and Risk Treatment

A risk register is a controlled record of identified risks and management decisions. It should be understandable to technical and non-technical stakeholders. Typical fields include:

A well-written risk statement has the form: “Because of [vulnerability], [threat] may cause [event], resulting in [consequence].” For example: “Because remote access accounts are not protected by multifactor authentication, an attacker may use stolen passwords to enter the finance network, resulting in fraudulent payment changes and operational disruption.”

Treatment options

Risk treatment normally involves four options:

1. Avoid: stop the activity that creates unacceptable risk. For example, an organisation may discontinue an insecure legacy service.
2. Reduce or modify: implement controls that reduce likelihood or impact. Examples include patching, multifactor authentication, network segmentation, encryption, tested backups, and staff training.
3. Share or transfer: allocate some financial or operational consequences to another party through insurance, outsourcing, or contractual arrangements. Transfer does not remove accountability and may not cover regulatory or reputational harm.
4. Retain or accept: knowingly keep the risk within approved tolerance. Acceptance should be documented by an authorised risk owner, with conditions and review dates.

Treatment selection should consider effectiveness, cost, feasibility, dependencies, user impact, legal requirements, and the possibility that controls introduce new risks. A control is not effective merely because it exists on paper; it must be implemented, understood, monitored, and periodically tested.

4. Governance, Roles, and Policies

Cybersecurity governance is the system by which an organisation directs and controls security. It links security decisions to business objectives and clarifies who is accountable.

The board or governing body provides oversight, approves strategic direction, and ensures that significant risks are understood. Senior management allocates resources, approves risk appetite, and ensures that security responsibilities are integrated into operations. A chief information security officer or equivalent security leader develops the security programme, advises management, and coordinates risk reporting.

Business and information owners classify assets, approve access, define business requirements, and accept residual risk. IT and security teams implement and operate controls. Human resources supports screening, onboarding, disciplinary processes, and termination procedures. Procurement and legal teams address supplier obligations, contracts, privacy, and regulatory requirements. Internal audit provides independent assurance; it should not audit controls for which it has operational responsibility.

A policy hierarchy commonly contains:

• Policy: mandatory, high-level management direction;
• Standard: specific mandatory requirements, such as password or encryption standards;
• Procedure: ordered steps for carrying out an activity;
• Guideline: recommended practice where professional judgement is permitted;
• Record: evidence that an activity occurred, such as an access review or training register.

Policies should have an owner, approval authority, scope, version, effective date, review cycle, exception process, and enforcement provisions. They should be communicated in language appropriate to their audience and supported by training.

5. Assurance, Audit, and Compliance

Compliance means meeting an obligation. Obligations may arise from legislation, regulations, contracts, industry codes, licences, or internal policies. Assurance is informed confidence that governance, risk management, and controls are designed and operating effectively. Audit is a systematic, independent, and documented examination against defined criteria.

An audit typically includes planning, determining scope and criteria, collecting evidence, evaluating findings, reporting results, and following up corrective actions. Evidence may include configuration records, access logs, policies, training records, incident tickets, vulnerability reports, and interviews. A screenshot alone may demonstrate a configuration at one moment but not ongoing operation; auditors therefore seek reliable and repeatable evidence.

Internal audit supports management and the governing body. External certification audits may assess conformity with a standard. A certification should not be confused with absolute security: it demonstrates conformity within a defined scope and audit programme, not immunity from attack.

6. Major Cybersecurity Frameworks

NIST Cybersecurity Framework

The NIST Cybersecurity Framework (CSF) is a risk-based framework for managing cybersecurity outcomes. Its commonly taught functions are Identify, Protect, Detect, Respond, and Recover. The functions describe broad outcomes rather than prescribing one technology. The CSF can be used to describe a current profile, define a target profile, identify gaps, and prioritise improvements. The 2.0 edition places greater emphasis on the Govern function, which addresses organisational context, strategy, roles, policy, oversight, and supply-chain risk.

ISO/IEC 27001

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It requires organisational context, leadership, planning, support, operation, performance evaluation, and improvement. Risk assessment and treatment are central. Annex A provides a reference set of information security controls, but organisations select controls according to their risks and document their applicability. Certification applies to the defined ISMS scope and requires independent assessment by an accredited certification body.

CIS Controls

The CIS Critical Security Controls provide prioritised, practical safeguards. They help organisations establish a baseline, particularly where resources are limited. Examples include asset inventory, software inventory, data protection, secure configuration, account management, vulnerability management, logging, and incident response. CIS Controls are operationally specific; they can complement a broader governance framework such as ISO/IEC 27001 or NIST CSF.

These frameworks are complementary rather than mutually exclusive. NIST CSF helps communicate outcomes and manage a programme; ISO/IEC 27001 provides a formal management-system structure; CIS Controls offer prioritised technical and operational safeguards.

7. Legal, Privacy, and Regulatory Obligations

Cybersecurity obligations depend on jurisdiction, sector, data type, and contractual relationships. Organisations should identify applicable laws rather than assuming that one framework satisfies every obligation.

Privacy laws commonly regulate the collection, use, disclosure, retention, security, and disposal of personal information. Important principles often include lawfulness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, confidentiality, and accountability. Privacy impact assessments can identify risks before a new system or process is introduced.

Organisations may need procedures for data-subject rights, breach notification, records retention, cross-border transfers, processor management, and secure disposal. A security incident is not automatically a legally reportable breach; reporting depends on the nature of the information, the likelihood of harm, jurisdiction, and statutory deadlines. Legal and privacy specialists should be consulted promptly.

Other obligations may address financial services, healthcare, critical infrastructure, education, payment cards, electronic communications, records management, or national security. Contracts may impose controls, audit rights, service levels, location restrictions, and notification requirements. Third-party risk management should assess suppliers before engagement and throughout the relationship.

Ethically, organisations should avoid excessive surveillance, discriminatory risk scoring, unnecessary data collection, and deceptive security claims. Security controls must protect people without unjustifiably undermining autonomy, privacy, or access to essential services.

8. Applied Case: Northbridge College Cloud Migration

The following is an illustrative case.

Background

Northbridge College plans to move its student records and learning platform to a cloud provider. The college processes identity information, grades, disability accommodations, payment records, and staff data. A small IT team supports the migration.

Problem

The initial proposal focuses on availability and cost but does not identify data owners, retention requirements, supplier responsibilities, or breach notification arrangements. Several administrators use password-only remote access, and backups have never been restored in a documented test.

Analysis

The team inventories the records, applications, identities, integrations, suppliers, and recovery dependencies. It classifies disability and payment information as highly restricted. A key risk statement is: “Because privileged cloud accounts use password-only authentication, an attacker may take over an administrator account, resulting in unauthorised disclosure or alteration of student records.” The team rates likelihood as 4 and impact as 5, giving a qualitative score of 20, classified as critical under the college’s matrix.

A second risk concerns recovery: incomplete backup testing could cause prolonged loss of access after ransomware or provider failure. A third concerns the supplier’s use of subprocessors and international data locations.

Approach and solution

The college assigns an information owner, defines a cloud security standard, and requires multifactor authentication for privileged access. It applies least privilege, separates administrative accounts, encrypts data in transit and at rest, enables central logging, and reviews alerts. Contracts specify security responsibilities, breach notification, data location, deletion at termination, evidence requirements, and audit rights. The college performs a privacy impact assessment, tests restoration, and schedules quarterly access reviews.

Outcome

The migration proceeds in stages. High-risk controls are implemented before sensitive data is transferred. Residual risks are recorded and accepted only by authorised owners. The college uses NIST CSF functions to organise the programme, CIS Controls to prioritise operational safeguards, and an ISO/IEC 27001-aligned ISMS structure to formalise governance and continual improvement.

Learning points

The case illustrates that cloud adoption transfers some operations but not accountability. Risk assessment must include people, processes, contracts, privacy, and recovery—not merely technical configuration. Evidence and repeated testing are necessary to demonstrate that controls operate as intended.

9. Challenges and Best Practices

Risk ratings can be subjective, data may be incomplete, and threat conditions change rapidly. A low rating may reflect poor understanding rather than low exposure. Framework implementation can also become a compliance exercise in which documents exist but controls are ineffective. Organisations should therefore explain assumptions, use multiple sources of evidence, distinguish inherent from residual risk, and review assessments after significant change.

Good practice includes maintaining an authoritative asset inventory; assigning accountable owners; prioritising internet-facing and privileged assets; applying secure configuration and timely vulnerability management; testing backups and incident plans; integrating privacy into system design; assessing suppliers; measuring control performance; and reporting risk in business language.

Metrics should support decisions. Useful measures include the percentage of critical assets with owners, overdue high-risk vulnerabilities, multifactor authentication coverage, successful backup restoration tests, time to contain incidents, and completion of corrective actions. Metrics should be interpreted carefully: a high number of detected incidents may indicate improved detection rather than worsening security.

Contemporary Developments

Cloud services, software supply chains, remote work, operational technology, and artificial intelligence have expanded the risk environment. AI systems introduce risks involving sensitive training data, prompt injection, inaccurate outputs, model theft, bias, and unclear accountability. Governance should require appropriate data handling, human oversight, testing, access control, monitoring, and documented use cases. AI does not replace risk ownership or professional judgement.

Regulatory expectations increasingly emphasise resilience, timely incident reporting, executive accountability, and supply-chain oversight. Organisations should monitor authoritative legal and regulatory sources because requirements differ across jurisdictions and change over time.

Chapter Summary

Cyber risk management links assets, threats, vulnerabilities, likelihood, impact, and consequences. A risk assessment identifies and prioritises uncertainty; a risk register records evidence, ownership, treatment, and review. Treatment may avoid, reduce, share, or retain risk, but residual risk should be accepted only by an authorised owner.

Governance establishes accountability through boards, management, asset owners, technical teams, legal and privacy functions, procurement, and independent assurance. Policies, standards, procedures, guidelines, and records provide a structured control environment. Audit and assurance provide evidence, but certification is not a guarantee of security.

The NIST CSF organises cybersecurity outcomes, ISO/IEC 27001 establishes an information security management system, and CIS Controls provide prioritised safeguards. Legal, privacy, regulatory, and contractual obligations must be identified within the applicable jurisdiction and sector. Effective cybersecurity is therefore a continuous, evidence-based management activity rather than a one-time technical project.

Key Terms

Asset: Something valuable that requires protection.

Threat: A potential cause of harm.

Vulnerability: A weakness that a threat may exploit.

Risk: The possibility of adverse consequences arising from uncertainty.

Likelihood: An estimate of how probable a risk event is.

Impact: The consequence if a risk event occurs.

Inherent risk: Risk before considering controls.

Residual risk: Risk remaining after controls are applied.

Risk appetite: The amount and type of risk an organisation is willing to pursue or retain.

Risk register: A controlled record of identified risks and management decisions.

Risk owner: The person accountable for managing or accepting a risk.

Control: A measure that modifies risk.

Risk treatment: The process of selecting and implementing a response to risk.

Governance: Direction, oversight, and accountability for organisational activity.

Assurance: Informed confidence that governance, risk, and controls are effective.

Audit: An independent, systematic examination against defined criteria.

ISMS: An Information Security Management System.

Privacy impact assessment: A structured assessment of privacy risks arising from a project or system.

Compliance: Fulfilment of applicable legal, regulatory, contractual, or internal requirements.

Supply-chain risk: Risk arising from suppliers, partners, products, or services.

Review Questions

Short Answer Questions

1. Distinguish between a threat and a vulnerability.
2. What is the difference between inherent risk and residual risk?
3. Name four possible risk treatment options.
4. What is the purpose of a risk register?
5. Why is certification not a guarantee that an organisation cannot be attacked?

Long Answer Questions

1. Explain how asset ownership and classification support effective cyber risk management.
2. Describe the roles of the board, senior management, asset owners, technical teams, and internal audit in cybersecurity governance.
3. Compare the purposes of the NIST CSF, ISO/IEC 27001, and CIS Controls.
4. Explain how privacy and contractual obligations influence cloud supplier selection.
5. Discuss the difference between compliance, assurance, and audit, including the importance of evidence.

Analytical / Application Questions

1. A public-facing application has a likelihood rating of 4 and an impact rating of 4. Using the chapter’s qualitative model, calculate its score and explain what additional information is required before selecting treatment.
2. A company discovers that its most sensitive database is backed up daily, but restoration has never been tested. Identify the asset, threat, vulnerability, likely consequences, and two appropriate treatments.
3. Design a short risk-register entry for a privileged account protected only by a password. Include a risk statement, proposed controls, residual-risk consideration, owner, and review requirement.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a vulnerability from a threat?

A. A vulnerability is a weakness; a threat is a potential cause of harm.

B. A vulnerability is always an incident; a threat is always a control.

C. A vulnerability measures impact; a threat measures likelihood.

D. A vulnerability is a business owner; a threat is an auditor.

Correct Answer: A. A vulnerability is a weakness; a threat is a potential cause of harm.

Question 2

An organisation rates likelihood as 3 and impact as 4 using its approved qualitative matrix. What is the risk score?

A. 7

B. 12

C. 34

D. 81

Correct Answer: B. 12

Question 3

Which risk treatment stops the activity that creates an unacceptable risk?

A. Transfer

B. Accept

C. Avoid

D. Monitor

Correct Answer: C. Avoid

Question 4

Who should normally accept residual business risk?

A. An authorised risk owner

B. Any end user

C. An external attacker

D. A network cable installer

Correct Answer: A. An authorised risk owner

Question 5

Which NIST Cybersecurity Framework function focuses on taking action during and after a cybersecurity event?

A. Identify

B. Protect

C. Respond

D. Inventory

Correct Answer: C. Respond

Question 6

What is the primary purpose of ISO/IEC 27001?

A. To provide only a list of firewall commands

B. To establish requirements for an information security management system

C. To replace all privacy laws

D. To guarantee that breaches cannot occur

Correct Answer: B. To establish requirements for an information security management system

Question 7

Which statement about CIS Controls is most accurate?

A. They provide prioritised practical safeguards.

B. They are exclusively a privacy regulation.

C. They eliminate the need for asset inventories.

D. They certify every cloud provider automatically.

Correct Answer: A. They provide prioritised practical safeguards.

Question 8

What does residual risk describe?

A. Risk before any controls exist

B. Risk remaining after controls are applied

C. Risk that has no owner

D. Risk that is legally impossible

Correct Answer: B. Risk remaining after controls are applied

Question 9

Which item is strongest evidence that a backup control operates effectively?

A. A statement that backups are important

B. An unapproved draft policy

C. A documented and successful restoration test

D. A marketing brochure from a supplier

Correct Answer: C. A documented and successful restoration test

Question 10

Why should privacy specialists be involved in a proposed system handling sensitive personal information?

A. To identify privacy obligations and risks before implementation

B. To approve all network cable colours

C. To remove the need for access controls

D. To guarantee that the system has no vulnerabilities

Correct Answer: A. To identify privacy obligations and risks before implementation