GUIDE · Enterprise Risk Management
Put Cyber Risk on the Same Register as Every Other Enterprise Risk.
We quantify and govern cyber risk in business terms so executives can accept, treat or transfer it with confidence.
- Cyber risk expressed in business terms
- Informed risk acceptance decisions
- Clear risk ownership
- 1Establish Context
- 2Identify Risk Scenarios
- 3Analyze and Evaluate
- 4Decide and Treat
- 5Monitor and Report
Executive Summary
- 01Cyber risk becomes useful to executives when it is rated on the same scales as every other enterprise risk.
- 02Appetite and tolerance statements turn security findings into clear decisions to accept, treat, transfer or avoid.
- 03Each risk needs a named business owner, a documented treatment choice and a review date.
The Challenge
Cyber risk is frequently reported in technical language that does not fit the enterprise risk register.
Without a shared method, leaders cannot compare a ransomware scenario with a credit or operational risk.
The DAAKYI Approach
DAAKYI aligns cyber risk with your enterprise risk framework, defines appetite and tolerance, and builds scenarios that express impact on services, finances and reputation.
Risk owners receive treatment plans they can track.
- 01
Risk framework alignment to ISO 31000
- 02
Risk appetite and tolerance statements
- 03
Scenario-based risk assessment
- 04
Treatment planning and tracking
In Depth
How the Discipline Works
Translate Technical Exposure into Enterprise Terms
A vulnerability count means little to a board. Enterprise risk management converts technical exposure into the same units used for other risks: service interruption, financial loss, regulatory consequence and reputational damage. Each cyber risk is described as a cause, an event and a consequence, then rated against the same likelihood and impact scales as the rest of the register. This allows a leadership team to place a ransomware scenario beside a credit concentration or a supplier failure and decide which deserves capital, attention or acceptance first. Consistent scales matter more than precise numbers.
Appetite and Tolerance Drive Decisions
Risk appetite states how much risk an organization is willing to pursue. Tolerance sets the limits around specific outcomes, such as how long a payment channel may be unavailable or how much customer data exposure is acceptable. Without these boundaries, every cyber finding becomes a debate. With them, a risk either sits inside tolerance and can be accepted, or sits outside it and requires treatment. The board sets appetite; management translates it into measurable thresholds; security teams then test whether current controls keep exposure within those thresholds.
Four Treatment Options, One Owner
Every risk that exceeds tolerance has four possible responses: avoid the activity, reduce likelihood or impact through controls, transfer part of the loss through insurance or contract, or accept the residual exposure knowingly. Each choice needs a named business owner, because the owner holds the budget and the consequence. Treatment plans record the chosen option, the controls involved, the target residual rating and a review date. Risk that is accepted is documented with the approver and the conditions under which the decision must be revisited, so acceptance is a decision rather than an oversight.
Cyber risk becomes manageable when someone with budget and authority owns it, rates it on the scale, and signs for it.
Capability Matrix
What the Service Includes
| Capability | Coverage | GUIDE | SECURE | OPERATE | Delivered Through |
|---|---|---|---|---|---|
| Risk Methodology | A method consistent with your enterprise framework. | GUIDE stage | – | – | Advisory Engagements |
| Scenario Analysis | Business-impact scenarios for priority threats. | GUIDE stage | – | – | Advisory Engagements |
| Risk Register Integration | Cyber risks owned and tracked alongside others. | GUIDE stage | – | – | Advisory Engagements |
| Treatment and Reporting | Plans, owners and periodic risk reporting. | GUIDE stage | – | – | Advisory Engagements |
Risk Methodology
A method consistent with your enterprise framework.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
Scenario Analysis
Business-impact scenarios for priority threats.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
Risk Register Integration
Cyber risks owned and tracked alongside others.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
Treatment and Reporting
Plans, owners and periodic risk reporting.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
How It Works
How Enterprise Risk Management Works
- 01Identify
- 02Analyze
- 03Treat
- 04Monitor
Methodology
The Method, Step by Step
- 1
Establish Context
Confirm the enterprise risk framework, scales, appetite statements and reporting cadence already in use. Identify critical services, information assets, regulatory obligations and the executives accountable for each. This step fixes the vocabulary so every later rating can be read by risk, finance and audit teams without translation.
- 2
Identify Risk Scenarios
Build scenarios from threat actors, attack paths and weak points that could disrupt priority services. Use adversary behavior catalogs such as MITRE ATT&CK to keep scenarios realistic. Each scenario states a cause, an event and a business consequence, and is validated with the service owner before any rating begins.
- 3
Analyze and Evaluate
Rate inherent risk, assess the effectiveness of existing controls, and derive residual risk using the organization's scales. Compare results with tolerance thresholds. Where quantification is appropriate, ranges and assumptions are written down so reviewers can challenge them. Risks outside tolerance move forward for treatment decisions.
- 4
Decide and Treat
Present options to the risk owner with cost, residual effect and dependencies. The owner selects avoid, reduce, transfer or accept. Selected treatments become tracked actions with owners, milestones and target ratings. Acceptances are signed by an authorized approver and given an expiry date.
- 5
Monitor and Report
Track key risk indicators tied to each scenario, such as unpatched critical systems or overdue treatment actions. Report movement against tolerance to executives and committees on a fixed cycle. Reassess scenarios after major incidents, acquisitions, new regulations or significant changes in technology, suppliers or business model.
Operating Model
Delivered from the GUIDE Pillar
Pillar position
GUIDE
Advisory, Risk & Assurance
Engagement model
Advisory Engagements
Fixed-scope assessments, strategy, compliance and testing.
Best for · Defined questions with a clear deliverable
Threat Scenarios
What It Looks Like in Practice
Ransomware on Core Operational Systems
How It Shows Up
Encrypted servers halt a customer-facing service, and recovery depends on backups nobody has tested end to end.
Response
The scenario is rated for downtime against tolerance, and treatment focuses on recovery capability, segmentation and the decision rules for any extortion demand.
Compromise of a Critical Supplier
How It Shows Up
A vendor with privileged access or sensitive data suffers a breach, and the organization learns of it from a third party.
Response
Supplier exposure is placed on the register with its own owner, and treatment sets contractual notification duties, access limits and exit options.
Missed Regulatory Notification
How It Shows Up
An incident is contained technically, but legal and compliance teams are informed too late to meet reporting duties.
Response
The risk is rated for regulatory consequence, and treatment defines escalation thresholds and decision authority before an incident occurs.
Privileged Misuse or Cloud Misconfiguration
How It Shows Up
An overpowered account or an exposed storage service creates data exposure without any external attacker.
Response
Scenarios include internal and accidental causes, and key risk indicators track privileged access and configuration drift.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Ransomware on Core Operational Systems | Encrypted servers halt a customer-facing service, and recovery depends on backups nobody has tested end to end. | The scenario is rated for downtime against tolerance, and treatment focuses on recovery capability, segmentation and the decision rules for any extortion demand. |
| Compromise of a Critical Supplier | A vendor with privileged access or sensitive data suffers a breach, and the organization learns of it from a third party. | Supplier exposure is placed on the register with its own owner, and treatment sets contractual notification duties, access limits and exit options. |
| Missed Regulatory Notification | An incident is contained technically, but legal and compliance teams are informed too late to meet reporting duties. | The risk is rated for regulatory consequence, and treatment defines escalation thresholds and decision authority before an incident occurs. |
| Privileged Misuse or Cloud Misconfiguration | An overpowered account or an exposed storage service creates data exposure without any external attacker. | Scenarios include internal and accidental causes, and key risk indicators track privileged access and configuration drift. |
Outcomes
What Your Institution Gains
- Cyber risk expressed in business terms
- Informed risk acceptance decisions
- Clear risk ownership
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Cyber Risk Assessment Report | Records scenarios, ratings, assumptions and control evidence in a form audit can trace. |
| Risk Scenario Catalog | Gives leaders a reusable set of business-impact scenarios for priority threats. |
| Appetite and Tolerance Statements | Defines the thresholds that separate acceptable exposure from exposure needing treatment. |
| Treatment Plan Register | Tracks each chosen response with its owner, milestones and target residual rating. |
| Executive Risk Reporting Pack | Shows risk movement against tolerance in the format the risk committee already uses. |
| Role | Responsibility |
|---|---|
| Board or Risk Committee | Sets risk appetite and challenges whether reported exposure sits within it. |
| Chief Risk Officer | Maintains the enterprise framework and ensures cyber risk uses the same scales as other risks. |
| Business Risk Owner | Selects the treatment option and accepts accountability for residual risk. |
| Cyber Risk Advisor (Provider Side) | Builds scenarios, tests control assumptions and prepares decision-ready options without taking ownership of the risk. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Reactive
Cyber risk is described in technical terms and sits outside the enterprise register. Decisions follow the latest incident or audit finding.
Stage 2
Defined
A method and scales exist, and cyber risks are recorded. Ownership and tolerance remain unclear, so acceptance is informal.
Stage 3
Integrated
Cyber risks sit on the enterprise register with named owners, tolerance thresholds and tracked treatment plans reviewed by a committee.
Stage 4
Optimized
Scenario ratings draw on measured indicators and quantified ranges. Risk insights shape investment, insurance and strategic decisions.
Frameworks and Regulation
The Standards That Shape This Work
ISO 31000
Provides the principles and process for identifying, analyzing, evaluating and treating risk. It lets cyber risk follow the same logic as every other enterprise risk.
ISO/IEC 27001
Requires a defined risk assessment and treatment process for information security. Its 2022 Annex A holds 93 controls in four themes against which treatment choices are compared.
NIST CSF 2.0
Its six functions are Govern, Identify, Protect, Detect, Respond and Recover. The Govern function ties cybersecurity outcomes to risk strategy, roles and oversight.
Buyer Guidance
Choosing the Right Provider
What to look for
- Look for a provider that works inside your existing enterprise risk framework rather than imposing a separate scoring model.
- Look for scenarios written as cause, event and consequence, not lists of vulnerabilities.
- Look for explicit treatment of risk acceptance, including approver, conditions and expiry.
- Look for assumptions that are documented and open to challenge from your risk and finance teams.
Questions to ask a provider
- How will you map your ratings to our existing likelihood and impact scales?
- How do you decide when quantification adds value and when it adds false precision?
- Who signs for risk acceptance, and how is that recorded?
- How will treatment progress be tracked after the engagement ends?
Regulatory & Industry Context
The Obligations This Service Supports
Methods follow ISO 31000 and ISO/IEC 27001 risk requirements and support regulator expectations for documented risk governance.
Frameworks DAAKYI helps clients implement
- ISO 31000
- ISO/IEC 27001
- NIST CSF
Framework references describe client implementation support, not DAAKYI certifications.
Technical Detail
For Architects and Security Leads
Framework and regulatory alignment
- ISO 31000
- ISO/IEC 27001
- NIST CSF
Methods follow ISO 31000 and ISO/IEC 27001 risk requirements and support regulator expectations for documented risk governance.
Architecture reference
How Enterprise Risk Management Works: Identify → Analyze → Treat → Monitor.
DAAKYI aligns cyber risk with your enterprise risk framework, defines appetite and tolerance, and builds scenarios that express impact on services, finances and reputation.
Building a Defensible Risk Scenario
A defensible scenario separates five elements: threat actor, target asset, attack path, event and consequence. Attack paths can be mapped to MITRE ATT&CK, which organizes adversary behavior into 14 tactics, so control coverage is tested against how intrusions actually progress. Frequency is estimated as a range, informed by exposure, control strength and incident history, not a single point. Loss is split into categories: response and recovery effort, service downtime, regulatory consequence, third-party liability and reputational effect. Where financial quantification is used, calibrated ranges can feed a simulation that produces a distribution of outcomes. Every input records its source and confidence so reviewers can challenge it.
Linking Controls to Residual Risk
ISO/IEC 27001 requires risk treatment options to be chosen, the controls necessary to implement them to be determined, and those controls compared against Annex A. The 2022 edition lists 93 controls in four themes: organizational, people, physical and technological. ISO/IEC 27002 supplies implementation guidance. The result is a Statement of Applicability that justifies which controls apply and why. Residual risk is then re-rated and approved by the risk owner. NIST CSF 2.0 complements this by describing current and target profiles across Govern, Identify, Protect, Detect, Respond and Recover, which helps show how control improvements are expected to reduce scenario ratings.
Glossary
Key Terms
- Risk Tolerance
- The acceptable variation around a specific outcome, such as a maximum period of service unavailability.
- Residual Risk
- The exposure that remains after existing or planned controls have been applied.
- Key Risk Indicator
- A measure that signals rising exposure to a scenario before a loss occurs.
- Risk Scenario
- A structured description of a cause, an event and the business consequence that follows.
Related
Explore Connected Capabilities
Proof Points
What We Can Stand Behind
- Every stage of DAAKYI's delivery methodology produces documented, auditable deliverables.
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About Enterprise Risk Management
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss Enterprise Risk Management with DAAKYI
Tell us about your environment and obligations. A DAAKYI specialist for Enterprise Risk Management will respond.
Talk to a Cybersecurity Expert