Risk management
How can we help you with risk management?
Risk management
- What is cyber risk management?
Cyber risk management is the systematic work of identifying, analyzing, evaluating and managing risks associated with the organization's digital assets and IT.‑environments.
It’s not just about technology, it’s about connecting cybersecurity to business risk. The organization must therefore understand which digital assets are critical, what threats exist, and what consequences these could have for the business.
Mature work means that risks are documented, prioritized based on business impact, managed through clear measures and followed up continuously. This is the basis of ISO 27001, NIS2 and DORA.
- How do you conduct a cyber risk analysis?
A cyber risk analysis is carried out in a structured manner and in several steps.
First, the organization's assets are identified, then threats and vulnerabilities are mapped. The next step is to assess the consequences if something happens, both from a business perspective and a‑ and regulatory perspective. The probability is then assessed and a risk level is determined.
Finally, it is decided how the risk should be managed – for example, by reducing it with safety measures, accepting it or transferring it.
The most important thing is that the analysis is linked to the business's priorities and not solely driven by technical perspectives.
- How do you identify critical assets?
Identification of critical assets is based on what the business depends on to function.
This can be systems, data, processes or external dependencies. An asset is considered critical if its failure would have a major impact on the business, for example in the form of downtime, financial losses or regulatory consequences.
In practice, information classification, business mapping and business impact analysis (BIA) are often used. This is also central to DORA, where organizations need to understand their critical functions and dependencies.
- How do you work with third-party risks?
Third-party risks include all risks associated with suppliers and external parties.
A structured approach means that the organization identifies its suppliers, classifies their criticality, sets requirements in contracts, conducts risk assessments and monitors compliance on an ongoing basis.
A central principle is that responsibility cannot be outsourced – even if a service is delivered by an external party, the organization is still responsible for the risks.
- How can cyber risks in the supply chain be reduced?
Third-party risks include all risks associated with suppliers and external parties.
A structured approach means that the organization identifies its suppliers, classifies their criticality, sets requirements in contracts, conducts risk assessments and monitors compliance on an ongoing basis.
A central principle is that responsibility cannot be outsourced – even if a service is delivered by an external party, the organization is still responsible for the risks.
- What risks do DORA and NIS2 focus on?
DORA and NIS2 focus on similar types of risks, but with different focus areas.
DORA targets the financial sector and focuses on ICT‑risks, operational resilience, supplier dependencies and the ability to manage and recover from incidents.
NIS2 is broader and covers critical operations in several sectors, with a focus on cybersecurity risks, systematic risk management, management responsibility and incident reporting.
Common to both sets of regulations is that risks should be managed in a structured manner, linked to operations and monitored continuously.