What is cyber risk management?
In short: Cyber risk management is the process of identifying, assessing, treating and monitoring risks to information and technology assets, in line with the organisation's risk appetite. In Saudi Arabia it is a named requirement in the main frameworks: NCA ECC-2:2024 includes a Cybersecurity Risk Management subdomain, the SAMA Cyber Security Framework has a Cyber Security Risk Management and Compliance domain, and SAMA's IT Governance Framework adds an IT risk management domain. ISO/IEC 27005 and ISO 31000 provide the method.
What Saudi frameworks require
| Framework | Requirement |
|---|---|
| SAMA Cyber Security Framework | A Cyber Security Risk Management and Compliance domain: identify and assess cyber risks to information assets and align residual risk with the organisation's risk appetite. |
| SAMA IT Governance Framework | An IT risk management domain, one of its four domains alongside IT governance and leadership, IT operations management and system change management. |
| NCA ECC-2:2024 | A Cybersecurity Risk Management subdomain within the Cybersecurity Governance domain, for government entities and CNI operators. |
| ISO/IEC 27005:2022 | International guidance on managing information security risks, commonly used to design the method. |
| ISO 31000:2018 | General risk management guidelines that connect cyber risk to enterprise risk management. |
The cyber risk management process in 7 steps
- 1
Establish context and inventory assets
Define scope, risk appetite and criteria, and maintain an inventory of information assets with owners and classifications.
- 2
Identify threats and vulnerabilities
Use threat intelligence, vulnerability scans, penetration tests, incidents and third-party reviews to find what could go wrong.
- 3
Analyse likelihood and impact
Score each risk consistently — most Saudi organisations use a 5×5 likelihood-impact matrix shared with the enterprise risk register.
- 4
Evaluate against appetite
Compare inherent and residual risk with the board's appetite to decide what needs treatment first.
- 5
Treat the risk
Mitigate with controls, transfer (for example through insurance or contracts), avoid the activity, or formally accept with an owner and expiry date.
- 6
Monitor with key risk indicators
Track KRIs with thresholds and alerts so rising exposure is visible before it becomes an incident.
- 7
Report and review
Report the top cyber risks, trends and treatment progress to management and the board, and reassess after incidents and significant change.
Example cyber key risk indicators (KRIs)
- Percentage of critical vulnerabilities patched within the agreed timeframe
- Multi-factor authentication coverage for privileged and remote access
- Phishing simulation click rate
- Number of critical vendors without a current security assessment
- Mean time to detect and to respond to security incidents
- Success rate of backup restoration tests
- Open high-risk audit and assessment findings past due date
Cyber risk belongs in the enterprise risk register
Cyber risk is business risk. Recording cyber risks in the same risk register as financial, operational and compliance risks — with the same scoring scale — lets the board compare them directly and stops cybersecurity being managed in isolation. It also makes the link to third-party risk and business continuity explicit.
Cyber risk management checklist
- Document a cyber risk methodology aligned with ISO/IEC 27005 and your enterprise risk framework.
- Maintain an information asset inventory with owners and classifications.
- Score cyber risks on the same scale as enterprise risks.
- Set board-approved risk appetite and escalation thresholds.
- Assign an owner, treatment and due date to every risk above appetite.
- Track cyber KRIs with thresholds and automated alerts.
- Report top cyber risks and trends to the board regularly.
- Reassess after incidents, major changes and new threat intelligence.
Frequently asked questions
What is the difference between cyber risk management and cybersecurity?
Cybersecurity is the set of controls that protect systems and data. Cyber risk management decides which risks matter most, how much risk is acceptable and where to invest in controls — and reports that to the business.
Is cyber risk management required by NCA ECC?
Yes. NCA ECC-2:2024 includes a Cybersecurity Risk Management subdomain within its Cybersecurity Governance domain, which in-scope government and critical infrastructure entities must implement.
What does SAMA require for cyber risk?
The SAMA Cyber Security Framework includes a Cyber Security Risk Management and Compliance domain, and SAMA's IT Governance Framework includes an IT risk management domain. Member Organisations must identify, assess and treat these risks in line with their risk appetite.
What is ISO/IEC 27005?
ISO/IEC 27005:2022 is the international standard giving guidance on managing information security risks. It is often used with ISO 27001 to design the risk assessment and treatment method.
Who should own cyber risk?
Business owners own the risks to their processes and assets; the CISO or cyber security function sets the method and challenges ratings; the board sets appetite and oversees the top risks.
How does Siraaj support cyber risk management?
Siraaj provides a risk register with heatmaps, risk and control self-assessment (RCSA), key risk indicators with threshold alerts, incident management and a real-time risk dashboard, so cyber risks sit alongside every other enterprise risk.
Sources
The official texts and expert commentary this page is based on. Always confirm requirements against the current version published by the regulator.
- Cyber Security Framework (v1.0) — Saudi Central Bank (SAMA)
- SAMA Rulebook: Information Technology Governance Framework — Saudi Central Bank (SAMA)
- Essential Cybersecurity Controls (ECC-2:2024) — National Cybersecurity Authority (NCA)
- ISO/IEC 27005:2022 Guidance on managing information security risks — International Organization for Standardization (ISO)
- ISO 31000:2018 Risk management — Guidelines — International Organization for Standardization (ISO)
Related guides
One risk register for cyber and enterprise risk
Score cyber risks on the same scale as every other risk, monitor KRIs with alerts, and report the top exposures to your board from one dashboard.