Risk Management Program (RMP)

• Cybersecurity-focused risk management practices to implement a program-level governance function.
• Holistic approach to risk management aligns with NIST, ISO & SCF risk management practices.
• Leverages the Security, Compliance & Resilience Risk Management Model (SCR-RMM) from the SCF for scalability.
• Immense time & cost savings - enables subject matter experts to fill in the details that only they know.

Don't Write It From Scratch.

Nearly every framework and regulation expects you to manage cybersecurity risk in a documented, repeatable way. If an auditor or board member asked how your organization identifies, rates, treats, and tracks risk, could you show a defined process, or just a spreadsheet someone updates occasionally? Building a credible risk management program from a blank page takes specialized expertise most teams lack. The Risk Management Program (RMP) gives you a running start: an editable, program-level risk management playbook aligned to NIST, ISO, and the SCF's Risk Management Model (SCR-RMM), covering how risk is identified, assessed, treated, and reported. It gets you roughly 80 to 90 percent of the way there, then your team tailors the risk criteria and workflows to your organization.

The Cybersecurity Risk Management Program (RMP) is essentially a risk management playbook for how an organization addresses the broader concepts of risk management that are not provided by a policy or standard. It captures the details that explain how risk is actually managed, day to day, by the people who execute risk-based controls.

All companies have a need to manage risk. Most companies are compelled to manage risk and these requirements come from a broad range of sources. Regardless of your industry, there are likely requirements to manage cybersecurity risk and failing to manage risk could leave your company liable from non-compliance from these requirements:

No Software To Install

The RMP is a one-time purchase of editable Microsoft Office-based documentation templates. There is no software to install, no agent to deploy, no account to provision, and no cloud environment to configure. If the organization can open and edit Microsoft Word files, the RMP is ready to use.

This deployment model is intentional. Risk management documentation benefits from being in the organization's own hands, inside its own document management systems, rather than locked inside a vendor's SaaS tool. Once delivered, this product belongs to the buyer.

How Does the RMP Solve These Problems?

The RMP addresses each risk management documentation challenge with concrete, measurable outcomes. It is designed to take an organization from a blank document to a defensible, customizable risk management program in weeks rather than months — with a controls-based assessment template included for the actual risk assessment work.

Cost Savings Estimate

When you look at the costs associated with either (1) hiring an external consultant to write cybersecurity documentation for you or (2) tasking your internal staff to write it, the cost comparisons paint a clear picture that buying from ComplianceForge is the logical option. Compared to hiring a consultant, you can save months of wait time and tens of thousands of dollars. Whereas, compared to writing your own documentation, you can potentially save hundreds of work hours and the associated cost of lost productivity. Purchasing the RMP from ComplianceForge offers these fundamental advantages when compared to the other options for obtaining quality cybersecurity documentation:

How Much Customization Remains?

Given the difficult nature of writing templated risk management documentation, ComplianceForge aims for approximately an 80% solution because it is impossible to write a 100% cookie-cutter document that can be equally applied across every organization. Risk management depends on the specific organization's risk appetite, risk tolerance, and governance structure, so the remaining work is fine-tuning the RMP with the specific information that only the organization knows.

In practice, customization is filling in the blanks and following the guidance provided to identify the who, what, when, where, why, and how for the specific risk environment. Typical customization tasks include adding the company name and logo, naming the risk approvers and risk owners, tailoring impact and likelihood scales, defining the risk register format, and removing sections that do not apply to the organization.

Why Risk Management Documentation Matters

Formal cybersecurity risk management documentation has become a baseline expectation across regulatory, contractual, and customer due-diligence contexts. NIST 800-171 Section 3.11 requires risks to be periodically assessed. PCI DSS Section 12.2 requires companies to perform a formal risk assessment. HIPAA Security Rule requires accurate and thorough assessment of potential risks. MA 201 CMR 17.00, Oregon ITPA, GLBA Safeguards Rule, and the FTC Act Section 5 all carry related risk-assessment obligations. The SEC cybersecurity disclosure rule for public companies requires materiality assessment of cybersecurity risks.

Vendor contracts increasingly require recurring risk assessments. Not having a cybersecurity risk management program can lead to breach of contract, lost bids, and elevated insurance premiums. The RMP provides a complete, defensible risk management baseline that can be customized to the organization's risk appetite and governance structure in weeks rather than months.

The RMP serves as a foundational element in your organization's cybersecurity risk program. It can stand alone or be paired with other specialized products we offer.

Even with larger organizations that have Enterprise Risk Management (ERM) departments, the RMP can tie into the broader risk management framework for any organization. What ComplianceForge.com did was simply reduce the complexity by creating a usable risk management framework that any company can implement to manage risks:

• How risk is categorized
• Risk management fundamentals
• Risk maturity levels
• Defining risk appetite & risk tolerance thresholds
• Evaluating & prioritizing risks
• Risk treatment
• Documenting risk & reporting findings
• Defining potential impact
• Defining potential likelihood
• Defining criticality levels for assets / systems / data
• Sources of risk

Based on NIST 800-37 Rev2, COSO 2013, COBIT 5 & ISO 31010 Best Practices!

The RMP is an editable Microsoft Word document that contains the requirements needed to establish a risk management program. Quite simply, the Cybersecurity Risk Management Program (RMP) provides your company with evidence that a documented risk management program exists to address operational risks associated with information and technology. From a Capability Maturity Model (CMM) perspective, if a risk program is not documented, incomplete or ad-hoc, it could be a liability for a company, since it indicates negligence with a statutory, regulatory or contractual requirement to manage risk. The RMP addresses the due care component of getting an organization to a mature level for managing risk.

Understanding Layers of Risk

Dependencies are of critical importance when assessing risk, since risk can have a cascading effect. Ideally, a risk assessment at a tactical level (e.g., assessment of a specific application or host) should leverage existing risk assessments that address “upstream” risks. For example, a well-designed and securely-coded application could be compromised if the host system it is running on is insecure. Similarly, the application could be made unavailable if the datacenter lacks measures to ensure uptime against natural or man-made threats.

As part of overall risk management, your company should perform several formal risk assessments, which are meant to be used as references for more detailed project-specific risk assessments. At a minimum, risk assessments should exist for commonly-leveraged aspects of your company's IT environment:

By being able to leverage those existing risk assessments, it will allow for more efficient assessments of applications. The RMP helps build this foundation for efficient risk management by framing risk according to the following concepts: