Skip to main content

Risk Management Frameworks (RMF)

A risk management framework describes the vocabulary, tools, and techniques for a coherent approach to risk, so all stakeholders work from the same definitions. The frameworks below are the ones you are most likely to encounter; each links to its source material so you can pick one to lean on.

Enterprise frameworks address any type of risk that could prevent the company from achieving its business objectives, while others focus on information security, cybersecurity, and privacy protection.

COSO Enterprise Risk Management​

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) helps organizations improve internal control and manage enterprise-wide risk.

Full Name
COSO Enterprise Risk Management Framework
Type
Enterprise risk framework
Authoritative Source
ERM Framework (2020)
Managed By
Committee of Sponsoring Organizations of the Treadway Commission (COSO)
Applies To
Any type of organizational risk

Factor Analysis of Information Risk (FAIR)​

FAIR quantifies risk in financial terms rather than qualitative ratings, which makes it the common choice when leadership wants risk expressed in dollars.

Full Name
Factor Analysis of Information Risk
Type
Quantitative risk model
Authoritative Source
fairinstitute.org
Managed By
FAIR Institute
Applies To
Information security and operational risk

International Organization for Standardization (ISO)​

ISO publishes two complementary risk standards: ISO/IEC 27005 for information security risks specifically, and ISO 31000 for risk of any type.

Full Name
ISO/IEC 27005:2022, Guidance on managing information security risks
Type
International standard
Authoritative Source
iso.org
Managed By
ISO/IEC JTC 1/SC 27
Applies To
Information security risks; applies to an ISMS as specified in ISO/IEC 27001 and 27002
Full Name
ISO 31000, Risk management guidelines
Type
International standard (guidelines)
Authoritative Source
iso.org
Managed By
ISO/TC 262
Applies To
Any type of risk, customizable to any organization and context

The ISO 31000 umbrella includes several related specifications, some still under development:

NIST Risk Management Framework​

The National Institute of Standards and Technology (NIST) RMF integrates security, privacy, and risk management activities into the system development life cycle, and is the framework behind Federal Information Security Modernization Act (FISMA) compliance for US federal systems.

Full Name
NIST Risk Management Framework
Type
Federal framework
Authoritative Source
csrc.nist.gov
Managed By
National Institute of Standards and Technology (NIST)
Applies To
US federal information systems under FISMA, and voluntary adopters

Note that NIST SP 800-53 revision 5 describes the Security and Privacy Controls for Information Systems and Organizations and SP 800-53B describes the control baselines. Related publications:

OCTAVE​

Full Name
Operationally Critical Threat, Asset and Vulnerability Evaluation
Type
Risk assessment method
Authoritative Source
cert.org/octave
Managed By
Software Engineering Institute, Carnegie Mellon University
Applies To
Organizational security risk assessments; developed on behalf of the US Department of Defense

Rapid Risk Assessment (RRA)​

Full Name
Rapid Risk Analysis
Type
Lightweight assessment methodology
Authoritative Source
infosec.mozilla.org
Managed By
Mozilla
Applies To
Fast, time-boxed risk decisions; designed to formalize a decision in about 60 minutes

Threat Agent Risk Assessment (TARA)​

Full Name
Threat Assessment and Remediation Analysis
Type
Engineering methodology
Authoritative Source
mitre.org
Managed By
MITRE
Applies To
Identifying and assessing cyber vulnerabilities and selecting effective countermeasures; part of MITRE's systems security engineering portfolio
Last updated on by Sarah Funkhouser