Governance · 8 min read

Security risk management: a practical operating model

Risk management works when it helps people make better decisions under uncertainty. The goal is not a perfectly ranked spreadsheet; it is timely, owned, evidence-informed action that keeps important business outcomes within tolerance.

Published Oct 08, 2026 · By InfoSec Consult

The practical finding

Many risk registers become stale because they are separated from delivery, architecture, incidents, procurement, and audit. The remedy is to make risk a decision record: connect each scenario to an owner, a treatment decision, supporting evidence, and the next trigger for review.

An operating model that holds up

Define risk criteria in business language: impact, likelihood, tolerance, escalation thresholds, and who can accept residual risk.
Identify scenarios rather than only listing assets. Describe threat, vulnerability or condition, event, consequence, existing controls, and affected objectives.
Use evidence to calibrate likelihood and impact: incidents, vulnerabilities, control results, threat intelligence, dependencies, and business continuity assumptions.
Select treatment deliberately: reduce, avoid, transfer, or accept. Give every treatment an owner, target date, required resources, and interim protection.
Link risks to controls and assurance. A control that is present but untested should not receive the same confidence as one with recent effective evidence.
Review risk after material change, incidents, new intelligence, major vulnerabilities, supplier changes, and control failures—not only at the annual review.

Avoid false precision

Scores are useful for prioritisation, but they are not measurements of truth. Record assumptions, confidence, uncertainty, and the reasons behind a rating. A high-confidence medium risk can deserve earlier treatment than a low-confidence high risk where critical facts are missing.

Make risk visible at the right level

Executives need trends, top scenarios, decisions required, and exposure against appetite. Delivery teams need actionable owners and dependencies. Control owners need specific weaknesses and evidence gaps. Use the same underlying risk record, but communicate it in the language each decision-maker can act on.

Scope note: Adapt the method to your organization's context, risk appetite, contractual commitments, and applicable standards. No scoring model replaces informed professional judgement.