IT and Cyber Risk Management: Frameworks, Process and Tools
An IT risk management framework is a structured method for identifying, assessing, treating and monitoring risks to your technology, data and operations.
You can build one on a published standard, such as NIST CSF 2.0 or ISO/IEC 27005:2022.
They then run it as a repeatable process, with a risk register, named risk owners and continuous monitoring.
The framework is what turns scattered IT and cyber risk data into decisions leadership can act on.
This guide compares the main IT risk management frameworks and sets out the process step by step.
It also covers the tools that keep the program current and how to report IT and cyber risk to your board.
What Is an IT Risk Management Framework, and How Is IT Risk Different From Cyber Risk?
An IT risk management framework is the set of standards, roles and repeatable steps your organization uses to manage technology risk.
IT risk covers any threat to systems and data, including outages and vendor failures, while cyber risk concerns loss of confidentiality, integrity or availability.
You can manage the two together, because the same assets, controls and owners carry both kinds of risk.
A failed patch is an IT risk, and the unpatched vulnerability it leaves behind is a cyber risk.
That overlap matters: the Verizon 2026 Data Breach Investigations Report found that 31% of the breaches it analyzed started with software vulnerabilities.
In that dataset, vulnerabilities overtook stolen passwords as the top way attackers got in.
That puts penetration testing and vulnerability management inside IT risk management, not only security operations.
Shared rating criteria and connected IT and security registers that roll up into enterprise reporting give you unified risk visibility across both.
NIST SP 800-221 takes a similar approach, placing information and communications technology (ICT) risk inside enterprise risk management.
Which IT Risk Management Frameworks Do Enterprises Use?
Six widely published frameworks support IT risk management: NIST CSF 2.0, NIST SP 800-37, ISO/IEC 27005, ISO 31000, COBIT and Open FAIR.
Each framework answers a different question, so you can combine an outcome framework, a risk assessment method and a quantitative analysis approach.
The table below compares the six IT risk management frameworks by publisher, version, purpose and certification.
Framework | Publisher | Current version (year) | Primary use |
NIST CSF 2.0 | NIST | 2.0 (2024) | Cybersecurity outcomes and governance |
NIST SP 800-37 (RMF) | NIST | Rev. 2 (2018) | System-level risk and authorization |
ISO/IEC 27005 | ISO and IEC | 4th edition (2022) | Information security risk guidance supporting ISO/IEC 27001 |
ISO 31000 | ISO | 2nd edition (2018) | Enterprise-wide risk principles |
COBIT | ISACA | 2019 (COBIT 7 certificate from October 27, 2026) | Governance and management of enterprise IT |
Open FAIR | The Open Group | O-RT 3.1, O-RA 2.1 (2025) | Quantitative risk analysis |
What Does NIST CSF 2.0 Cover?
NIST CSF 2.0 is a taxonomy of cybersecurity outcomes, published by NIST on February 26, 2024, for organizations of any size or sector.
NIST CSF 2.0 defines outcomes, not methods, and leaves the choice of practices and controls to your team.
The framework is organized by six Functions: Govern, Identify, Protect, Detect, Respond, and Recover.
What Is the NIST Risk Management Framework?
NIST SP 800-37 Rev. 2, published in December 2018, defines the Risk Management Framework (RMF) for security and privacy risk.
The RMF runs in seven steps (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) and draws its controls from NIST SP 800-53.
The RMF suits teams that need formal, system-by-system authorization decisions.
How Do ISO/IEC 27005 and ISO/IEC 27001 Work Together?
ISO/IEC 27001:2022 sets the certifiable requirements for an information security management system (ISMS), including a risk management process adapted to your size and needs.
ISO/IEC 27005:2022 gives guidance on how to run that process, from identifying and assessing information security risks to treating them.
In short, ISO/IEC 27001 says what your ISMS must do, and ISO/IEC 27005 explains how to handle the risk part.
You certify against ISO/IEC 27001, not ISO/IEC 27005, because ISO/IEC 27005 is guidance rather than a set of requirements.
ISO/IEC 27005:2022 is the fourth edition, published in October 2022.
ISO/IEC 27005 adapts the general principles of ISO 31000 to information security, so your ISMS risk method can align with enterprise risk management.
When Should You Use ISO 31000?
You should use ISO 31000:2018 when you need one risk management approach across the whole enterprise, not only for information security.
ISO 31000:2018 fits when IT and cyber risk must share criteria and language with other risks in your enterprise risk management (ERM) program.
ISO 31000:2018 sets risk management principles and guidelines that apply to any organization, sector, or type of risk.
ISO 31000 is the wrong choice if you need a certificate, because ISO 31000:2018 is not certifiable.
For a certifiable information security standard, pair ISO 31000 with ISO/IEC 27001:2022.
ISO last confirmed the 2018 edition in 2023, and the standard is now marked for revision.
Where Does COBIT Fit in IT Risk Management?
COBIT fits at the governance layer of IT risk management, where leadership sets direction and oversight for enterprise information and technology (I&T).
You should use COBIT when IT risk decisions must sit inside wider IT governance, not only inside security or compliance teams.
COBIT is ISACA’s framework for the governance and management of enterprise information and technology.
ISACA’s COBIT Focus Area: Information and Technology Risk shows how to apply COBIT to I&T risk practices.
COBIT sets who decides and how IT risk is overseen, while ISO/IEC 27005 and Open FAIR cover how you assess and measure that risk.
ISACA scheduled its COBIT 7 Foundations certificate to replace the COBIT 2019 version on October 27, 2026.
The COBIT 2019 Foundations program sunsets on April 26, 2027.
ISACA’s COBIT page still presents COBIT 2019 as the framework edition, so confirm which edition your auditors expect.
How Does Open FAIR Quantify IT Risk?
Open FAIR quantifies IT risk by splitting each risk scenario into two factors: Loss Event Frequency (LEF) and Loss Magnitude (LM).
The Open FAIR Risk Taxonomy defines risk as the probable frequency and probable magnitude of future loss, expressed in economic terms.
A simple way to read the model is Risk = Loss Event Frequency (LEF) × Loss Magnitude (LM).
The Open FAIR Risk Taxonomy does not prescribe a single deterministic calculation, so treat the formula as shorthand for the model.
Open FAIR breaks the two factors down further:
Threat Event Frequency: how often a threat agent is likely to act against an asset within a given timeframe
Vulnerability (susceptibility): the probability that a threat event becomes a loss event
Loss Magnitude: the probable economic loss from a loss event, split into primary loss and secondary loss
Open FAIR has two parts: the Risk Taxonomy (O-RT) Version 3.1 and the Risk Analysis standard (O-RA) Version 2.1, updated in May 2025.
Cyber risk quantification (CRQ) is the practice of estimating how often losses may occur and how large they may be, in financial terms.
Open FAIR gives CRQ a shared vocabulary, which helps when finance and the board review your risk register.
What Are the Steps in the IT Risk Management Process?
A practical IT risk management process runs in six repeatable steps: set context, identify assets and risks, assess, treat, monitor, and report.
These steps align with the risk process in ISO 31000:2018, which covers identifying, analyzing, evaluating, treating, monitoring, and communicating risk.
Set the context: define scope, risk appetite and the criteria your team uses to rate likelihood and impact.
Identify assets and risks: build an inventory with IT asset management, then record the threats and vulnerabilities that apply to each asset.
Assess each risk: rate inherent risk, test the existing controls and calculate residual risk.
Treat each risk: choose to mitigate, transfer, accept or avoid, and assign an owner and a due date.
Monitor continuously: track control status, new vulnerabilities and asset changes between formal assessments.
Report and review: roll results up to leadership, then revisit risk appetite and ratings at a set interval.
A risk register is the central record of identified risks, with each risk's owner, rating, treatment and linked controls.
Inherent risk is the level of risk before controls, and residual risk is what remains after controls and other risk responses are applied.
In spreadsheet-based programs, steps 3 and 5 can be hard to keep current, because ratings and control evidence go stale between review cycles.
What Tools Do You Need to Run an IT Risk Management Framework?
To run an IT risk management framework, you need at least a shared risk register, an asset inventory, and named risk owners.
Control mapping is a recommended capability that a governance, risk and compliance (GRC) platform can provide.
Control mapping is linking each control to the framework requirements it addresses, which can support evidence reuse across frameworks.
Evidence reuse still depends on each requirement's scope, period and assessment criteria.
Control mapping is also the basis of cybersecurity compliance automation across several frameworks.
IBM's 2026 Cost of a Data Breach Report linked extensive security AI and automation to USD 1.93 million lower average breach costs.
That difference is measured against organizations using no security AI or automation.
The finding covers security AI and automation broadly, not GRC platforms specifically.
Commugen is a no-code cyber GRC automation platform that helps enterprises manage cyber risk.
When you compare tools, check framework coverage, register-to-control links, security stack integration, and board reporting speed.
How Do You Report IT and Cyber Risk to Leadership?
Report IT and cyber risk to leadership by rolling risks into an enterprise risk register, expressed in business impact and tied to risk appetite.
NIST IR 8286 Rev. 1, finalized in December 2025, explains how to roll cybersecurity risk registers up to the enterprise level.
NIST IR 8286 Rev. 1 uses two terms: the cybersecurity risk register (CSRR) and the enterprise risk register (ERR).
The board does not need every CSRR entry.
The board needs the few risks that sit outside appetite, the trend behind them and the decisions it must make.
A board-level IT risk report can cover four items:
Top risks by residual rating, with the change since the last report
Estimated financial exposure for those risks, using CRQ where you have it
Control effectiveness and overdue remediation by owner
Risks outside appetite that need a decision to accept, fund or transfer
Cyber risk dashboards for CISOs can keep these four items current between board meetings.
Keep the same rating scale across IT and cyber risk, so leadership compares like with like.
How Can Commugen Help You Run Your IT Risk Management Framework?
Commugen brings IT and cyber risk into one no-code platform, so your risk register no longer lives in spreadsheets.
Commugen’s automated cyber security risk management module manages your full risk register and measures inherent and residual risk.
With risk measured, your team can prioritize the most important risks, mitigate them first, and build cyber resilience through automation.
Customizable dashboards give your board a current snapshot of risk, and no-code workflows adapt to the framework or methodology you already use.
Book a demo to see how Commugen supports your IT risk management framework.
Frequently Asked Questions
Which IT Risk Management Framework Should a Mid-Size Enterprise Start With?
A practical starting point is NIST CSF 2.0 as the outcome framework, because NIST CSF 2.0 is free and fits any sector.
Add ISO/IEC 27005:2022 for the assessment method if you hold or plan ISO/IEC 27001 certification.
Add Open FAIR later, once your risk register is stable enough to support financial estimates.
Can You Use NIST CSF 2.0 and ISO/IEC 27001 Together?
Yes, you can run NIST CSF 2.0 and ISO/IEC 27001:2022 together through control mapping.
Control mapping links each control to the matching CSF outcome and ISO/IEC 27001 requirement.
One control test can then support evidence for both frameworks, subject to each requirement's scope and assessment criteria.
A cyber GRC platform can update linked compliance views when a mapped control changes.
How Often Should You Run an IT Risk Assessment?
Set formal IT risk assessment intervals based on risk and your obligations, with an annual review as a baseline.
Reassess when significant changes are proposed or occur, such as a new system, vendor or regulation.
Who Owns IT Risk in an Enterprise?
Assign accountability for the IT risk management framework explicitly to the chief information security officer (CISO), technology leadership, or head of GRC.
Business and system owners manage individual risks and their treatment plans.
Escalation and risk acceptance follow delegated authority, with risks outside appetite going to senior leadership or the board.
Recording ownership in the risk register keeps remediation moving.
