UK, US and international risk management frameworks organised by scope.
General / Enterprise Risk Management
Frameworks applicable across industries for broad organisational risk management.
Framework
Origin
Description
Link
ISO 31000
International (ISO)
International standard providing principles and guidelines for risk management applicable to any organisation regardless of size or industry. Focuses on integrating risk management into governance and decision-making.
Enterprise Risk Management framework that integrates risk management with strategy and performance. Emphasises governance, culture, and aligning risk appetite with strategic goals. Updated in 2017.
Information security risk management standard. Provides guidelines for establishing a systematic approach to information security risk management supporting ISO 27001.
Framework for organisations responsible for essential services to assess cyber security posture. Based on 14 principles across 4 objectives. Now integrated into NHS DSPT for Category 1 organisations.
Government-backed certification scheme focusing on 5 technical controls to protect against common cyber attacks. Required for many government contracts.
Voluntary framework with 6 core functions: Govern, Identify, Protect, Detect, Respond, Recover. Version 2.0 released February 2024 added Govern function. Applicable to all organisations.
18 prioritised security controls providing prescriptive, actionable guidance. Updated June 2024 to align with NIST CSF 2.0. Maps to HIPAA, PCI DSS, NIST and more.
Voluntary framework for managing AI-related risks. Released January 2023. Four core functions: Govern, Map, Measure, Manage. Includes AI RMF Playbook for implementation guidance.
World's first AI Management System standard. Certifiable framework addressing ethical considerations, transparency, and responsible AI governance. Published December 2023.
Risk-based regulation categorising AI systems. Phased enforcement from 2024-2026. Applies to organisations offering AI systems in EU regardless of location.
IT governance and management framework from ISACA. Aligns IT with business goals, supports audit and compliance. Flexible integration with other standards.
Quantitative risk analysis framework expressing cyber risk in financial terms. Provides taxonomy, methodology and computational model for risk quantification. Now an Open Group standard.
Operationally Critical Threat, Asset, and Vulnerability Evaluation. Qualitative framework for identifying and managing information security risks. OCTAVE Allegro is the lightweight variant.
Annual self-assessment tool for organisations accessing NHS patient data. Based on National Data Guardian's 10 data security standards. Category 1 organisations now use CAF alignment.
Service Organisation Control auditing framework based on 5 Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, Privacy. Type I and Type II reports.