It's difficult to evaluate cyber risk with total certainty. Companies rarely have full visibility into cybercriminals' tactics, their own network vulnerabilities or more unpredictable risks like severe weather and employee negligence. Plus, the same kinds of cyberattacks can have different consequences between companies. Data breaches in the healthcare sector cost USD 10.10 million on average, whereas breaches in hospitality cost USD 2.9 million, according to the IBM Cost of a Data Breach report.

For these reasons, authorities like the National Institute of Standards and Technology (NIST) suggest approaching cyber risk management as an ongoing, iterative process rather than a one-time event. Revisiting the process regularly allows a company to incorporate new information and respond to new developments in the broader threat landscape and its own IT systems.

To ensure that risk decisions account for the priorities and experiences of the whole organization, the process is typically handled by a mix of stakeholders. Cyber risk management teams may include directors, executive leaders like the CEO and chief information security officer, IT and security team members, legal and HR and representatives from other business units. 

Companies can use many cyber risk management methodologies, including the NIST Cybersecurity Framework (NIST CSF) and the NIST Risk Management Framework (NIST RMF). While these methods differ slightly, they all follow a similar set of core steps.

Risk framing is the act of defining the context in which risk decisions are made. By framing risk at the outset, companies can align their risk management strategies with their overall business strategies. This alignment helps avoid ineffective and expensive mistakes, like deploying controls that interfere with key business functions. 

To frame risk, companies define things like the following:

The scope of the process: What systems and assets will be examined? What kinds of threats will be looked at? What timeline is the process working on (e.g., risks in the next six months, risks in the next year, etc.)?

Asset inventory and prioritization: What data, devices, software and other assets are in the network? Which of these assets are most critical to the organization?

Organizational resources and priorities: What IT systems and business processes are most important? What resources, financial and otherwise, will the company commit to cyber risk management?

Legal and regulatory requirements: What laws, standards or other mandates must the company comply with? 

These and other considerations give the company general guidelines when making risk decisions. They also help the company define its risk tolerance—that is, the kinds of risks it can accept and the kinds it cannot.

Companies use cybersecurity risk assessments to identify threats and vulnerabilities, estimate their potential impacts and prioritize the most critical risks.

How a company conducts a risk assessment will depend on the priorities, scope and risk tolerance defined in the framing step. Most assessments evaluate the following: 

Threats are people and events that could disrupt an IT system, steal data or otherwise compromise information security. Threats include intentional cyberattacks (like ransomware or phishing) and employee mistakes (like storing confidential information in unsecured databases). Natural disasters, like earthquakes and hurricanes, can also threaten information systems.

Vulnerabilities are the flaws or weaknesses in a system, process or asset that threats can exploit to do damage. Vulnerabilities can be technical, like a misconfigured firewall that lets malware into a network or an operating system bug that hackers can use to take over a device remotely. Vulnerabilities can also arise from weak policies and processes, like a lax access control policy that lets people access more assets than they need.

Impacts are what a threat can do to a company. A cyberthreat could disrupt critical services, leading to downtime and lost revenue. Hackers could steal or destroy sensitive data. Scammers could use business email compromise attacks to trick employees into sending them money.

The impacts of a threat can spread beyond the organization. Customers who have their personally identifiable information stolen during a data breach are also victims of the attack.

Because it can be hard to quantify the exact impact of a cybersecurity threat, companies often use qualitative data like historical trends and stories of attacks on other organizations to estimate impact. Asset criticality is also a factor: The more critical an asset is, the more costly attacks against it will be.

Risk measures how likely a potential threat is to affect an organization and how much damage that threat would do. Threats that are likely to happen and likely to cause significant damage are the riskiest, while unlikely threats that would cause minor damage are the least risky.

During risk analysis, companies consider multiple factors to assess how likely a threat is. Existing security controls, the nature of IT vulnerabilities and the kinds of data a company holds can all influence threat likelihood. Even a company's industry can play a role: The X-Force Threat Intelligence Index found that organizations in the manufacturing and finance sectors face more cyberattacks than organizations in transportation and telecommunications.

Risk assessments can draw on internal data sources, like security information and event management (SIEM) systems, and external threat intelligence. They may also look at threats and vulnerabilities in the company's supply chain, as attacks on vendors can affect the company. 

By weighing all of these factors, the company can build its risk profile. A risk profile provides a catalog of the company's potential risks, prioritizing them based on criticality level. The riskier a threat is, the more critical it is to the organization. 

The organization monitors its new security controls to verify that they work as intended and satisfy relevant regulatory requirements. 

The organization also monitors the broader threat landscape and its own IT ecosystem. Changes in either one—the emergence of new threats or the addition of new IT assets—can open up new vulnerabilities or make previously effective controls obsolete. By maintaining constant surveillance, the company can tweak its cybersecurity program and risk management strategy in nearly real time.