Risk Management

What is risk management?

Risk management is the continuous process by which an organisation systematically identifies, analyses, evaluates and treats risks to its objectives, and monitors the risks that remain, so that it can make well-founded decisions about what to accept and what to control. The international reference standard is ISO 31000:2018, which defines risk as the effect of uncertainty on objectives. In IT and OT environments, risk management is not only about data and confidentiality, but also about process safety, plant availability, the environment and the safety of people.

The aim of risk management is not to avoid every risk, but to choose consciously and demonstrably which risks you accept and which you reduce.

🧠 Why is risk management needed?

Every organisation faces more potential risks than it has budget and people to address. Risk management makes the trade-off explicit: which threat hits the most important processes hardest, and which control delivers the greatest risk reduction per euro? Without that trade-off, controls get chosen on gut feeling, on the basis of the most recent incident, or because a vendor pushed for them.

🔄 How does the risk management process work?

Clause 6 of ISO 31000 describes a process that recurs in almost every other framework, from ISO 27005 for information security to IEC 62443-3-2 for industrial systems. Its core has six parts:

1. Establish scope, context and criteria - which installation, which processes and what risk appetite? Define in advance what is unacceptable, for example injury, an environmental release or more than eight hours of production downtime.
2. Risk identification - what can go wrong? Think of cyberattacks, equipment failures, human error, fire, power outages and sabotage.
3. Risk analysis - how large are the likelihood and the consequence, given the controls already in place?
4. Risk evaluation - which risks exceed the criteria and must be treated, and in what order?
5. Risk treatment - select and implement controls, then reassess the residual risk.
6. Monitoring, recording and reporting - are the controls working as intended, are there new threats, and are decisions and residual risks recorded for the board and regulators?

In the standard, communication and consultation (clause 6.2) and monitoring and review (clause 6.6) are not separate final steps: they run through all the other steps. So involve the people who know the installation, such as operators, maintenance staff and process engineers, from the start.

Steps 2 to 4 together make up the risk assessment, where each step and method is worked out in detail. The outcome is recorded in a risk register so that ownership, deadlines and progress stay visible. The process is cyclical: a change to the installation, a new incident or fresh threat information is a reason to run through it again.

🛠️ What risk treatment options are there?

ISO 31000 lists seven options that you can combine. In practice they are often summarised as avoid, reduce, transfer and accept.

Sharing mainly shifts the financial damage: accountability for safety and continuity stays with the organisation itself.

🏭 What makes risk management different in OT?

In IT, confidentiality often comes first; in OT, safety and availability take priority. A cyber incident in a factory or water treatment plant can have physical consequences, and SCADA and control systems often run for decades on software that cannot simply be patched. That calls for additional choices:

• Cross-disciplinary cooperation - an OT risk analysis requires knowledge of IT security, process engineering, maintenance and production. An IT team on its own cannot oversee the physical consequences.
• Linking cyber and process safety - a HAZOP or LOPA shows which protection layers must prevent a hazardous situation. If an attacker can disable such a layer, that scenario belongs in the cyber risk analysis as well. This is the core of Cyber-Informed Engineering.
• Zones and security levels - IEC 62443-3-2 divides an installation into zones and conduits using the Zones and Conduits Model and sets a target security level for each zone.
• Compensating controls - where patching is not possible, you reduce likelihood or consequence through segmentation, monitoring and defence in depth.
• Supply chain and suppliers - maintenance connections and third-party components are a risk source in their own right; see supply chain risk and Third Party Risk Management.

📋 How does risk management relate to standards and legislation?

Risk management is the common foundation beneath almost every framework for information security, safety and quality. Each framework fills in the process for its own domain.

For organisations within scope of the Dutch Cybersecurity Act, the duty of care has applied since 15 August 2026. A documented risk management process is how you demonstrate that the chosen measures are appropriate.

🔧 How do you set up risk management in practice?

A workable risk management process for an organisation with both IT and OT usually consists of the following building blocks:

1. Set risk appetite and criteria - the board decides which consequences are unacceptable. Use one matrix for IT and OT, for example 5×5 likelihood × impact, with impact scales for safety, environment, production, finance and reputation.
2. Map assets and processes - without an up-to-date asset inventory or CMDB you will miss risks. A Business Impact Analysis shows which processes are most critical.
3. Assess risks per process or zone - combine threat intelligence, vulnerabilities and existing controls. Methods such as FMEA, HAZOP, bow-tie and threat modelling each help at their own level. The companion standard IEC 31010:2019 describes dozens of assessment techniques with their strengths and limitations.
4. Assign owners - every risk gets an owner in line management, not just the CISO or the security team.
5. Plan and track controls - record deadlines in the risk register and reassess the residual risk once controls are in place.
6. Link to change management - every change through MOC gets a brief risk check, so that new risks do not slip in unnoticed.
7. Report and repeat - discuss the key risks with the board at least once a year, and more often after incidents or major changes. Lessons from incident management should feed back into the risk register.

A simple example from a risk register:

❓ Frequently asked questions

What is the difference between risk management and risk assessment?

Risk management is the complete, continuous process of establishing context, assessing, treating, monitoring and reporting. A risk assessment is one part of it: identifying, analysing and evaluating risks. Without the surrounding steps, a risk assessment remains a snapshot with no follow-up.

Is risk management mandatory?

For many organisations, yes. NIS2 and its Dutch implementation, the Cybersecurity Act, require essential and important entities to take appropriate measures based on a risk-based approach. ISO 27001 certification, the BIO for government bodies and quality rules such as GMP also require demonstrable risk management.

Which standard covers risk management?

ISO 31000 is the general guideline for risk management and applies to any type of risk, but you cannot be certified against it. For information security, ISO 27005 works out the process within an ISMS under ISO 27001. For industrial automation, IEC 62443-3-2 describes the risk assessment per zone and conduit.

How often should risk management be repeated?

Risk management is a cycle, not a one-off project. A full reassessment usually takes place at least once a year, and additionally after major changes to the installation, after a serious incident or when new threats become known. The risk register is kept up to date in between.

Who is responsible for risk management?

The board holds ultimate responsibility for risk management and sets the risk appetite. Under NIS2 and the Dutch Cybersecurity Act, the management body must approve the cybersecurity measures, oversee their implementation and undergo training itself. Day-to-day execution lies with risk owners in line management, supported by, for example, a CISO or risk manager.

How does OT risk management differ from IT risk management?

OT risk management puts safety and availability first, because a failure or attack can cause physical harm, environmental damage or production downtime. It also has to deal with long-lived systems that cannot easily be patched, so compensating controls such as segmentation play a larger role. Standards such as IEC 62443 and methods such as HAZOP and LOPA are therefore added to the IT toolkit.

📌 In summary

Risk management connects threats, vulnerabilities and consequences with deliberate choices about controls. ISO 31000 provides the process, ISO 27005 and IEC 62443 work it out for IT and OT, and NIS2 and the Dutch Cybersecurity Act make it mandatory for many organisations.

Risk management is the foundation of a safe, reliable and resilient organisation: if you do not assess and follow up risks in a structured way, you are working blind, especially in complex IT and OT environments.