Risk management is the process of deciding which cybersecurity risks an organization will address, how, and when. It starts with an assessment of systems, assets, data, and capabilities, then connects findings to business objectives and an acceptable level of risk. A strategy defines risk appetite, tolerance, decision-making responsibilities, and priorities so that limited resources go where they can reduce the most consequential exposure. section 1.5.3 section 5.3 section 1.2
A repeatable approach turns that strategy into decisions:
- Assess gaps and record risks in a risk register or Plan of Action and Milestones (POAM). Record when each risk was discovered, what must be done, who is responsible, and the time frame. section 5.3.2
- Categorize systems by confidentiality, integrity, and availability; select and implement controls suited to their risk classification and applicable requirements; then assess whether the controls deliver the expected reduction. section 5.3
- Have owners authorize the resulting position, including residual risk—the risk left after mitigation—and continuously monitor controls as threats and business goals change. section 5.3
Metrics make the process reviewable. At each risk-register review, track identified and addressed risks, overdue risks, and changes over time. Compare counts with severity and age: a falling total alone does not show whether the highest-risk items were resolved. Ratios of identified to addressed risks can indicate mitigation progress, while slipped due dates can prompt a review of obstacles and resource allocation. section 5.3.2 section 1.2
Reading a risk dashboard
After a healthcare technology organization introduces patch management, automated monitoring, and security-team training, its dashboard shows fewer critical and high vulnerabilities and faster incident detection and containment. Twenty high vulnerabilities remain. The actionable conclusion is not simply that the program worked: keep those vulnerabilities prioritized, check performance against response targets, and review whether the improvements persist. section 6.3.3
Table 1.3 NIST CSF v2.0 with six main functions and categories
| Category |
Function |
| Govern |
Organizational context Risk management Supply-chain risk Roles and responsibilities Policies and procedures Oversight |
| Identify |
Asset management Risk management Improvement |
| Protect |
Access control Awareness and training Data security Platform security Infrastructure resilience |
| Detect |
Continuous monitoring Adverse event analysis |
| Respond |
Incident response Incident analysis Incident reporting Incident mitigation |
| Recover |
Incident recovery Incident communication |
The NIST Cybersecurity Framework v2.0 table places risk management under both Govern and Identify, alongside functions for protecting, detecting, responding, and recovering. section 1.5.3
Figure 6.6 On the left, the TechMed risk assessment dashboard before the risk management program is implemented. In this figure, the bottom metrics are displayed as a percentage to indicate the percentage of incidents that were within the predefined target of hours. For example, 40% of the incidents were detected within the 12-hour target detection time. On the right, the risk assessment dashboard after implementing the risk management program.
The before-and-after dashboard helps distinguish reduced vulnerability counts from the share of incidents meeting time targets; both views matter when evaluating progress. section 6.3.3
