Compliance FrameworksInternational
ISO 31000
Risk management - principles, framework, process for organisation-wide risk management.
Risk management - principles, framework, process for organisation-wide risk management.
| Region | International |
| Country or scope | International |
| Sector | General |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers ISO 31000
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for ISO 31000.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for ISO 31000 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ISO31000-6.3 Scope, Context and Criteria | The risk management process must define its scope and understand the internal context, which for a software system means the system is named and its contents enumerated (ISO 31000:2018 clause 6.3, scope, context and criteria) | Scan |
ISO31000-6.4.2 Risk Identification | Risks must be found, recognised and described, including sources of risk, which for software requires an inventory of the components where risk can arise (ISO 31000:2018 clause 6.4.2, risk identification) | Scan |
ISO31000-6.4.3 Risk Analysis on Best Available Information | Risk analysis must comprehend the nature and level of risk using the best available information, which for software components requires version data to assess exposure to known weaknesses (ISO 31000:2018 clause 6.4.3, risk analysis) | Scan |
ISO31000-6.6 Monitoring and Review | Risks and the risk process must be continually monitored and reviewed, which presumes components remain unambiguously identifiable so new threat information can be mapped to them (ISO 31000:2018 clause 6.6, monitoring and review) | Scan |
ISO31000-6.7 Recording and Reporting | The risk management process and its outcomes must be documented and reported through appropriate mechanisms, evidenced by identifiable, timestamped records of the assessed system (ISO 31000:2018 clause 6.7, recording and reporting) | Scan |
ISO31000-5.4 Framework Integration and Accountability | The risk management framework requires assigned accountability and integration into organisational processes, supported by provenance records showing who produced the system documentation and when (ISO 31000:2018 clause 5, framework/leadership and commitment) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
5.2 | Leadership and Commitment |
5.3 | Integration |
5.4 | Design of Risk Management Framework |
5.5 | Implementation |
5.6 | Evaluation of Risk Management Framework |
6.2 | Communication and Consultation |
6.3 | Scope, Context and Criteria |
6.4 | Risk Assessment |
6.5 | Risk Treatment |
6.6 | Monitoring and Review |
6.7 | Recording and Reporting |
Policy templates
Written for ISO 31000:
- Risk Management Policy
- Risk Assessment and Treatment Procedure
- Risk Monitoring and Reporting SOP
And 22 from the standard set, adapted to ISO 31000.