GV.RM-03 says cybersecurity risk management activities and outcomes are included in enterprise risk management processes. Cyber risk should not live in a separate silo. It competes for attention and money with financial, operational, legal and reputational risks, so it needs to be visible in the same place.
What good looks like
One company risk register, or a clean link between the security register and the company one. Cyber risks use the same scoring scale as other risks. The person who manages cyber risk is in the room when enterprise risk planning happens. Clear criteria say when a cyber risk gets escalated upward.
How to implement it
- Check whether your company already has an enterprise risk process. In a small firm it may be a quarterly leadership agenda item. Use that.
- Align the scoring scale. If the company scores impact in money or customer harm, translate cyber risks to the same units.
- Add cyber risks to the shared list and categorize them with the others: compliance, financial, operational, regulatory, reputational, safety.
- Invite the security owner to enterprise risk planning.
- Write escalation criteria, for example any risk above a defined score, or any risk touching a critical service, goes to leadership within a set time.
Evidence to collect
- The combined risk register or the mapping between registers.
- Enterprise risk meeting agendas showing cyber items.
- The escalation criteria and an example of one being used.
Common gaps
- Security keeps its own register in its own tool and leadership never sees it.
- Different scoring scales make cyber and business risks impossible to compare.
- Escalation is informal, so serious risks wait until someone remembers.
Why scale alignment matters
If cyber risks are scored one to five by technical severity and finance scores risks in dollars, the board cannot weigh a security fix against a new hire. Pick one language for impact and use it everywhere. Even a rough band such as under ten thousand, under one hundred thousand and over that works better than two incompatible scales.
Cyber risk in the leadership conversation
A useful pattern is one slide per quarter that lists the top five enterprise risks with cyber risks marked, each with an owner, a score on the shared scale and the current treatment. Leaders should be able to compare a ransomware scenario with a key customer loss or a supplier failure in the same view. That comparison is the point of enterprise risk management, and it is hard to do when cyber risk arrives as a separate technical report.
Escalation criteria in practice
Write the criteria as plain rules. For example: any risk scored in the top band goes to the leadership team within five business days; any risk that threatens a critical service goes to the CEO the same week; any accepted risk above the tolerance needs a named executive signature. Having those rules written down means a junior engineer does not need to guess whether something is serious enough to raise.
Quick check
We are small. Do we need a formal enterprise risk process?
No. A standing agenda item and one shared list is enough, as long as cyber risks appear next to the others.
Sources
- NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.RM-03: https://csrc.nist.gov/projects/cybersecurity-framework/filters
- NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework
The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.
