The European Union Agency for Cybersecurity (ENISA) issues an analysis of the interoperability potential of cybersecurity risk management frameworks and methodologies to improve decision-making.
The report (Interoperable EU Risk Management Framework) published today is primarily designed to assess the existing risk management frameworks and methodologies in order to identify those with the most prominent interoperable features.
What is security risk management?
Information security risk management consists of the coordinated activities of an organisation in order to control information security risks. These activities are inscribed in a process allowing to:
- establish the external and internal context;
- assess the risks and decide whether to address the risks;
- draw a plan to implement decisions made on how to manage the risks.
In order to reduce the risks to an acceptable level, the process includes an analysis of the likelihood of potential security breaches prior to making the decision on solutions to implement.
About the report
A systematic survey of risk management approaches was performed in different contexts such as industry, business, government, academia, etc. The process included a variety of inclusion criteria ranging from best practices, methodologies proposed as standards and guidelines by international and national standardisation bodies, etc.
Key European stakeholders interviewed could share their views which were considered in the process and shaped the analysis of the outcomes. This resulted in:
- A new ENISA inventory of risk management frameworks and methodologies;
- A study on the way to evaluate and categorise European Risk Management Frameworks based on their interoperability potential including a baseline of an EU-wide interoperability framework.
Key outcomes of the report
The analysis and research performed resulted in the compilation of the following information:
- the identification of fully developed national and sectorial risk management frameworks and methodologies and their components;
- the identification of specific features such as national or international scope, target sectors, size of target audience, maturity, compliance with relevant standards, compatibility with EU regulation and legislation, etc.
- the development of a methodology for the assessment of the interoperability potential of the identified frameworks based on a set of factors such as risk identification, risk assessment and risk treatment;
- the application of the methodology to identify frameworks with a higher interoperability potential.
The elements gathered in the study serve the purpose of providing keys to potentially form a more coherent EU-wide risk management framework.
Besides, the report includes a proposal for a new ENISA inventory of risk management frameworks and methodologies: the Compendium of Risk Management Frameworks with Potential Interoperability.
Background
Risk management is the process of identifying, quantifying, and managing the risks an organisation faces. The process aims to reach an efficient balance between the opportunities available to enhance prevention of cyber risks and reducing the vulnerabilities and losses. As an integral part of management practices and an essential element of good governance, risk management needs to be seeking to support organisational improvement, performance and decision-making.
ENISA contributes to risk management by collecting, analysing and classifying information in the area of emerging and current risks and the evolving cyber threat environment.
The aim of this work was not to build yet another risk management framework from scratch. It rather serves the purpose to exploit parts of existing schemes, based on the inventory work done in the introductory step of this project.
As next steps ENISA is planning to:
- Define interoperable terms between EU risk management frameworks & regulatory frameworks;
- Develop common/comparative risk;
- Create a Methodology & Protocol that helps Member States with the uptake of interoperability of proposed risk management framework.
Further information
Interoperable EU Risk Management Framework
Compendium of Risk Management Frameworks
Inventory of risk management frameworks and methodologies
ENISA risk management/risk assessment (RM/RA) framework: Guidelines on assessing Digital Service Providers (DSP) security and Operators of Essential Services (OES) compliance with the NISD security requirements
Contact
For questions related to the press and interviews, please contact press(at)enisa.europa.eu
Contact
For press questions and interviews, please contact: press@enisa.europa.eu.