Understand a process, prepare a document, check the evidence, or keep up to date.
Find your way in by stage, purpose, resource type or topic.
Choose any dropdown, in any order. Leave the rest open.
All life cycle stages, purposes, resource types and topics.
Agree the boundaries of an assessment before the work begins.
Stage 01 · Prepare or carry out the work
The scoping statement records assessment boundaries and responsibilities at initiation.
See an example of how information and system value can be assessed.
Stage 02 · Understand the process
A completed value assessment illustrates the judgement used to establish criticality.
Keep the risk management process in view while structuring your assessment.
Stages 03, 06 · Understand the process
The one-page process reference helps structure preliminary and detailed assessment.
Start documenting risks and the actions needed to treat them.
Stages 03, 07 · Prepare or carry out the work
A starter register supports recording preliminary assessment findings.
Use an outline to organise the content of a security plan.
Stages 05, 12 · Prepare or carry out the work
The outline helps prepare or transfer a documented security plan.
Set out the organisation’s approach to managing security risk.
Stage 05 · Prepare or carry out the work
The policy template supports documenting security governance arrangements.
A resource can serve more than one purpose or stage. Broad references and newsletter updates are labelled “Across the life cycle”.
Choose a resource, add it to your cart and check out—even when the price is $0. Checkout collects your email and includes a newsletter preference that you can opt out of.
The life cycle gives you another way into the same resources.
Choose a situation or select a stage on the map. Your purpose, resource type and topic choices stay in place.
The map and dropdowns search the same resource collection.
Every stage has a free guide, practical questions and suggested resources.
Security engaged; scope, tier, budget and risk owner set.
What we protect, what it is worth, who might act.
Coarse and options-level, while the concept can change.
The protection concept, the layers, the indicative cost.
Run the controls; manage incidents, changes and registers.
Rate controls on evidence of practice, not paperwork.
Still the right controls? Periodic and event-driven review.
Change of use, upgrade or exit — each one a risk decision.
Add these resources to your SRMBOK cart and check out at no charge.
Agree the boundaries of an assessment before the work begins.
View in the SRMBOK shopStart documenting risks and the actions needed to treat them.
View in the SRMBOK shopSupport a bow-tie workshop and review the resulting analysis.
View in the SRMBOK shopKeep the whole life cycle in view, from initiation to change and disposal.
View in the SRMBOK shopThe security risk management life cycle connects assessment, planning, delivery and operations. Its twelve decision gates mark key decisions. Six return paths show where to revisit earlier work when circumstances change.
Try the free NIST CSF 2.0 tool