Author
National Institute of Standards and Technology (NIST)
2 reading cards from 2 books · 2012–2024.
2 cards
Guide for Conducting Risk Assessments (NIST SP 800-30 Rev. 1) · 2012
A risk owner is someone who can allocate budget and stop an activity, not someone who keeps a register.
The definition in the NIST risk assessment guide (SP 800-30 Rev. 1, 2012) is useful precisely because it is dull: risk is a measure of how far an entity is threatened by a circumstance or event, as a function of adverse impact and likelihood of occurrence. ISO 31000:2018 says the same thing differently — the effect of uncertainty on objectives — and adds what the first phrasing lacks: risk is measured against objectives, not against assets. Three terms get confused constantly. Risk appetite is how much risk the organisation seeks in order to reach its objectives; it is a board decision, not a security team decision. Tolerance is the accepted deviation around that appetite, expressed as concrete thresholds that trigger a reaction. The risk owner is the person with the authority and accountability to treat it, meaning someone who can allocate budget and stop an activity. In ISO/IEC 27001:2022, clause 6.1.3 requires owners to approve the treatment plan and accept residual risks.
“Risk is a measure of the extent to which an entity is threatened by a potential circumstance or event, and is typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.”
The NIST Cybersecurity Framework (CSF) 2.0 · 2024
Governance is not an extra heading but the function that decides how all the others are applied.
Until 2024 the NIST framework had five functions: identify, protect, detect, respond, recover. Version 2.0, published on 26 February 2024, added a sixth — GOVERN — and moved it to the centre of the wheel. It is not an extra heading but an admission: risk strategy, executive expectations, policy, roles and authorities, supply chain risk and oversight are not technical activities, yet they decide how well the technical ones get done. The consequence is unwelcome for teams that start with tools. If nobody has decided which objectives the organisation defends, who decides, and with what budget, then detection and response are optimised in a vacuum. The same idea underpins clause 5 of ISO/IEC 27001, leadership: top management does not support the system, it is accountable for it. An auditor hunting for governance evidence reads written management decisions with a date and an author, not monitoring screens.
“GOVERN is in the center of the wheel because it informs how an organization will implement the other five Functions.”