Risk Assessments
From uncertainty to clear decisions
We tailor the method and level of detail to the decision to be made. NS 5814 provides a general framework, while NS 5832, ISO/IEC 27005, BIA in accordance with ISO/TS 22317, NIS2 and CER are used when the issue at hand requires it.
The analysis links assets, incidents, causes, consequences, vulnerabilities, barriers and uncertainty to the organisation's objectives. BIA highlights consequences over time and recovery needs. NIS2 and CER add requirements for digital resilience and for the resilience of critical societal functions respectively. Our multidisciplinary teams ensure that the findings can be translated into priorities, measures and governance.
The risk assessment may include
- clarification of purpose, object of analysis, scope, stakeholders, decision points and documentation requirements
- determination of risk criteria, consequence categories, assessment scales and risk acceptance criteria
- mapping and prioritisation of people, information, systems, buildings, processes, deliverables, reputation and other critical assets
- identification of internal and external dependencies, alternatives, redundancy, time to impact and expected recovery
- BIA in accordance with ISO/TS 22317:2021, mapping prioritised products, services, processes and activities, consequences over time, minimum requirements, dependencies and recovery objectives
- gathering and assessment of a relevant knowledge base through document analysis, interviews, workshops, site visits, incident data and external risk and threat assessments
- identification of hazards, threats, causes and relevant scenarios for both intentional and unintentional undesirable incidents
- assessment of likelihood or possibility, consequences and existing barriers that prevent, detect, delay, respond and recover
- vulnerability assessment of human, technological, organisational and physical factors, and of how the measures work together
- assessment of direct and indirect consequences for life and health, the environment, finances, operations and the ability to deliver, regulatory compliance, reputation and trust
- assessments against NIS2 of governance, digital assets, incident management, continuity, recovery, supply chains, the system life cycle and the effectiveness of technical, operational and organisational security measures
- assessments, following the all-hazards approach of the CER Directive, of critical services, significant disruptions, physical and organisational resilience and cross-sectoral or cross-border dependencies
- explicit assessment of uncertainty, data quality, assumptions, knowledge gaps and factors that may affect the conclusions
- compilation, evaluation and prioritisation of risk against the organisation's objectives, requirements and defined tolerance
- assessment of strategies for avoiding, reducing, sharing or accepting risk, with alternative measures assessed by effect, cost and feasibility
- preparation of a risk register, risk map, scenario overview, BIA results, action plan, responsibilities, deadlines and indicators for follow-up
- a plan for periodic updating and reassessment when there are changes in assets, threat landscape, organisation, technology, suppliers or framework conditions
What does the organisation receive?
The organisation receives a risk picture anchored with management, with clear priorities, responsibilities and measures. The deliverable may include an analysis report, a risk register, an overview of scenarios and dependencies, BIA results, a requirements or gap analysis and an action plan. The results can be used directly in corporate governance, internal control, emergency preparedness, continuity and project work.
← Back to Security Act and Risk Analysis