Reference Frameworks (ISO 31000, NIST RMF)
Two guiding frameworks for structuring risk
ISO 31000 offers principles and a generic process for managing any type of organizational risk, without prescribing specific technical controls, which makes it flexible but also requires adapting it to the cybersecurity context, while the NIST Risk Management Framework is designed specifically for information systems and defines a detailed cycle that runs from categorizing the system to selecting, implementing, assessing and monitoring concrete security controls. Choosing one or the other, or combining them, depends on the organization's context: ISO 31000 is useful as a general enterprise risk management framework that integrates cyber risk alongside other types of business risk, while NIST RMF provides the technical detail needed to manage the risk of specific information systems. In practice, many organizations use ISO 31000 as the risk governance structure at the corporate level and NIST RMF as the operational methodology within the technology area, avoiding having to choose between generality and technical depth.