ISO 31000

International guidelines for risk management across the entire organisation, not limited to information security.

ISO 31000 provides a general risk management framework: principles, a structure, and a process for identifying, analysing, evaluating, and treating risk. It applies to any type of organisational risk, from strategic to operational.

These are guidelines, not a certifiable standard like ISO 27001. The distinction from ISO 27005 is straightforward: ISO 31000 is a general risk framework, while ISO 27005 applies that framework specifically to information security risk.

The process is cyclical (PDCA): risk is not a snapshot but a motion picture. A new vendor, a new system, or a newly discovered vulnerability changes the picture, which is why the risk register must be actively monitored rather than filed away after an annual review.

In practice: see the relevant RealSec module.

Ryzyko rezydualne

The level of risk that remains after controls and safeguards have been implemented.

KRI

A measurable signal with an alert threshold that warns of rising risk before it materialises.

Compliance that connects.

Terms are the map. RealSec ties them to processes, systems and vendors in one engine.

Book a demo → Back to the glossary