Organisational Policies - Risk Management

The effective adoption of Chapter 01 - Risk Management - requires the existence of formal organisational policies that frame, legitimise and sustain the application of the practices described in this chapter.

---

📌 Fundamental note

⚠️ The operational practices prescribed in this chapter (classification, review, acceptance, traceability) must be formally legitimised by approved organisational policies.

These policies:

• Make the practice of application risk management visible and binding within the organisation;
• Allow security decisions to stop depending on individual initiative;
• Serve as the normative basis for internal and external audits.

📎 The requirement for formal risk classification and acceptance policies is an explicit expectation in standards such as ISO/IEC 27005, ENISA Risk Management, NIST SSDF and CIS Controls v8.

🧩 This chapter implements, in practice, what the policies define - the policy approves, the chapter operationalises.

---

🧾 Recommended policies

Policy Name	Mandatory?	Application	Minimum expected content
Application Risk Classification Policy	✅ Yes	All projects and product teams	Mandatory classification model (exposure, data, impact); moments of application; recording and tracking.
Residual Risk Acceptance Policy	✅ Yes	Security, management, product owners	Formal criteria for acceptance; those responsible; temporal validity; recording and traceability.
Periodic Risk Review Policy	✅ Yes	The whole organisation	Minimum frequency per level (12 / 6 / 3 months); mandatory triggers; evidence required.
Security Decision Traceability Policy	⚠️ Optional	Organisations subject to audit	Versioning of classifications; link to architecture, requirements and controls.

---

🧩 Correspondence with normative frameworks

Framework	Requirements covered by the policies above
ISO/IEC 27005	Identification (8.2), Assessment (8.3), Acceptance (8.5)
NIST SP 800-30	Steps 1–4 (Characterisation, Threats, Vulnerabilities, Impact)
NIST SSDF	RM.1 (Categorize SW), RM.2 (Assess Risk), RM.3 (Manage Risk)
ENISA Risk Management	Sec. 2.3, 3.1 - formal definition of risk assessment and acceptance policies
CIS Controls v8	Controls 2, 4 - policies for inventory, risk assessment and acceptance
OWASP SAMM	Governance > Risk Management (levels 1 and 2)

---

🧱 Suggested structure of each policy

Each organisational policy must contain, at a minimum:

• Objective and scope of the policy;
• Scope of application: who, where and when it applies;
• Mandatory rules and criteria (e.g. when to apply, how to classify, who approves);
• Roles and responsibilities (security, product, architecture, management);
• Documentation and traceability requirement;
• Review periodicity of the policy itself (e.g. annual).

---

✅ Final recommendations

• These policies must be officially approved by security management and by the organisation's management;
• They must be published and accessible to all teams;
• Their existence is a precondition for guaranteeing coherence, auditability and real security-by-design maturity;
• Their application must be aligned with the practices described in this chapter.

📌 Templates for these policies may be made available as complementary 60-*.md files in future versions of the manual.