Risk management replaces gut feeling with a decision you can retrace. Protecting everything equally means protecting nothing well enough.<\/p>\n
Identify what can go wrong. Assess it by likelihood and impact. Treat it by avoiding, reducing, transferring or deliberately carrying it \u2013 and monitor the outcome, because the situation changes.<\/p>\n","protected":false},"featured_media":0,"template":"","glossary_intl_set":[],"glossary_intl_cluster":[392],"glossary_intl_theme":[],"class_list":["post-29163","glossary_intl","type-glossary_intl","status-publish","hentry","glossary_intl_cluster-cybersecurity"],"acf":{"card_description":"A systematic way of handling security risk in an organisation.","nav_theme":"","nav_subtheme":"","dataset_version":"","term_inline":"","term_plural":false,"heading_overrides":null,"synonyms":null,"lead_definition":"Risk management is the systematic handling of security risk: risks are identified, assessed, treated and monitored. The aim is not to eliminate every risk but to decide deliberately which ones are carried.","at_a_glance":[{"bullet":"The aim is a deliberate decision<\/b>, not the absence of risk."},{"bullet":"Without an owner, a risk stays untreated."},{"bullet":"A risk register with no dates is a wish list."}],"intro_answer":"","steps_answer":"","steps":null,"examples":[{"example":"An availability risk is carried deliberately, because insuring it would cost more than the expected loss."},{"example":"A supplier risk is transferred contractually and tracked in the register with a review date."}],"misconception":[{"myth":"\u201cRisk management means eliminating all risk.\u201d","reality":"It means knowing which risks you carry \u2013 and making that choice deliberately and traceably."}],"faq":[{"q":"How often should a risk register be reviewed?","a":"At least annually, and always after significant change. The NIST Risk Management Framework<\/a> describes a proven approach."},{"q":"Does risk management need certification?","a":"No, but a management system to ISO 27001<\/a> gives the approach an audited structure."}],"compare_answer":"","compare":null,"variants":null,"signals_answer":"","signals":null,"protect_answer":"","prevent":null,"incident":null,"related_terms":null,"pillar_link":null,"sources":[{"publisher":"","name":"NIST Risk Management Framework","url":"https:\/\/csrc.nist.gov\/projects\/risk-management\/about-rmf","doc_type":"","group":"used"},{"publisher":"","name":"ISO\/IEC 27001","url":"https:\/\/www.iso.org\/standard\/27001","doc_type":"","group":"used"}],"reviewer":{"name":"Jakub Novak","qualification":"IT security","date":"2026-06-01"},"disclaimer":""},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t