Should cyber risk be in the company risk register?
Yes, written as business risks rather than as one technical line. Describe each risk in terms the board recognises: production stopped by ransomware, customer data stolen, payment fraud, a key supplier hacked, a fine for a missed reporting deadline. For each one, note the likely impact, the controls in place, who owns it and what is still missing. That makes cyber risk comparable with other risks when budgets are set, and it gives auditors and insurers a clear trail. Review the register at least once a year and after every serious incident. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. expects entities in scope to base their measures on a risk analysis, and ISO/IEC 27001 is built around one. NetSenX does not keep a risk register; it supplies evidence for the detection controls listed in it.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- How should the board approve a cyber security budget?
- What is the difference between a security alert and an incident?
- How does a cyber incident affect the sale of a company?
- What is cyber risk appetite, and why should the board set it?
- Should the board get cyber security reports from IT or from outside?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.