Services

ISO 31000 (Risk Management)

ISO 31000 isn't a certification standard — nobody gets "ISO 31000 certified." It's a set of principles and a framework for how an organization should think about and manage risk of any kind, not just cyber risk. That's actually its value: it gives you a common structure for talking about risk — identifying it, analyzing it, evaluating it, treating it, and monitoring it over time — that works whether the risk is a cyberattack, a supply chain disruption, a regulatory change, or a bad acquisition.

Most organizations already have something that looks like risk management: a spreadsheet somewhere called a "risk register," updated sporadically, that nobody outside the compliance team actually reads before making a decision. ISO 31000 is what it takes to turn that into something leadership actually uses — a process that's embedded in how decisions get made, not a document that exists to satisfy an auditor.

Who this is for

Organizations that need a credible, structured risk framework — because a board is asking for one, because a regulator or customer expects to see one, or because leadership has simply noticed that risk decisions are being made on gut feel and wants that to stop. It's also useful groundwork underneath more specific frameworks: a solid ISO 31000-style risk process makes NIST CSF, CMMC, or SOC 2 work easier, because you're not building risk thinking from scratch every time a new requirement shows up.

How I'd approach it

I don't believe in risk frameworks that exist on paper and nowhere else, so I build the process around how your organization actually makes decisions — who needs to weigh in, what information they need to see, and how often it needs refreshing to stay honest. That means establishing real risk criteria specific to your business rather than generic severity labels, building a risk identification and analysis process that pulls in the people who actually see the risk day to day, and setting up monitoring that catches when a risk's likelihood or impact has shifted instead of reviewing it once a year out of habit. The test of whether this worked isn't a clean audit — it's whether, six months from now, someone making a real decision actually reaches for the framework instead of working around it.

If your risk management feels more like paperwork than a tool, get in touch and let's fix that.