Guides to assessing, scoring, treating and reporting cyber risk for UK firms with 25 to 250 people. Framework-agnostic, and mapped down to ISO 27001 where it matters.
A risk register nobody reads is a list of risks you have accepted without deciding to.
Risk management is how a firm decides which threats to its information deserve money, time and attention, and which it will knowingly carry. It runs as a loop: identify what could go wrong, assess how likely and how damaging it would be, choose a treatment, then keep watching.
For a firm of 25 to 250 people, that loop does two jobs. It points a small security budget at the risks that matter. And it gives you a straight answer when an enterprise customer, an insurer or your board asks how you know you're covered.
The register is the record. The decisions are the point.
ISO 27001 builds its management system around this loop, in Clauses 6.1, 8.2 and 8.3. The method holds whichever framework you work to.
Every guide in this vault maps to a level. Start where you are.
The core concepts: frameworks, appetite, the register, the matrix and inherent versus residual risk.
Assess and treat risk, set the strategy, and extend the same method to your suppliers and operations.
Turn the register into early warning and money: key risk indicators and quantification.
In a firm your size, risk management usually lands on whoever looks after security, often alongside another job. That person should run the process. They shouldn't own every risk.
Each risk needs a risk owner: the person with the authority and the budget to treat it, usually the head of the function where the risk lives. ISO 27001 uses the same term.
Your board or leadership team sets the risk appetite and signs off the risk management strategy. Without both, every treatment decision is a guess at what leadership would accept.
Review on a set cadence, and again whenever something significant changes.
Short answers to the questions we hear most from firms setting up, or rescuing, their risk process.
It is the ongoing process of identifying, assessing, treating and monitoring risks to the confidentiality, integrity and availability of your information. The output is a set of decisions about which risks to reduce, avoid, transfer or accept, each with a named owner.
A risk assessment is one step: it identifies risks and scores their likelihood and impact. Risk management is the whole loop around it, including the treatment decisions, the owners and the monitoring that keeps the scores current.
ISO 27001 requires risk assessments at planned intervals and whenever significant changes are proposed or occur. In practice, a full assessment once a year plus a quarterly review of the top risks with leadership keeps the register live without turning it into a full-time job.
The person running security should run the process, but each risk belongs to the person with the authority and budget to treat it. Leadership sets the risk appetite those owners work within.
No single framework is mandatory. Firms working to ISO 27001 often follow ISO/IEC 27005 for method, and NIST SP 800-30 is a common alternative. A consistent method matters more than which one you pick: see risk management frameworks.
Every guide in one place. Filter by level.
Work with a Trust Architect to build a risk process your board and your enterprise customers can rely on: scored consistently, owned and reviewed.