IT and Cyber Risk Management: A Practical Guide (2027)

Almost every process in a modern organisation runs on technology. Payroll, sales, client files, email and even building access depend on systems that can fail or be attacked. That makes IT and cyber risk one of the top risks on most registers, whatever the sector or country. This guide explains what these risks are, how to assess them in a way the board will understand, which frameworks to use, and how to start without a large security team.

What Is IT and Cyber Risk?

IT and cyber risk is the chance that something goes wrong with an organisation's technology or data, and the harm that follows. The harm can be financial loss, disruption to operations, regulatory penalties, damage to reputation or harm to the people whose data you hold.

Like any risk, it only matters because of what it does to your objectives. A server going down is a technical event. The risk is that invoices cannot be sent at month end, or that a hospital cannot see patient records. Good risk management always describes IT and cyber risks in those business terms.

IT and cyber risk management is the repeatable process of identifying these risks, judging how serious they are, deciding what to do about them, and checking that the response works. It is not a separate world from enterprise risk management. It uses the same register, the same scoring scale and the same owners, with technical detail added underneath.

IT Risk vs Cyber Risk

The two terms overlap, and many organisations treat them as one category. The difference is in the cause.

	IT risk	Cyber risk
Scope	Anything that can go wrong with technology	Harm caused through digital systems, usually on purpose
Typical causes	Hardware failure, failed changes, ageing systems, poor projects, supplier outages, human error	Criminals, hostile insiders, hacktivists, state actors, malware
Examples	A software upgrade breaks the billing system	Ransomware encrypts the billing system
Main frameworks	IT governance and service management practices, plus the general risk standards	NIST CSF 2.0, ISO/IEC 27001, CIS Controls

In practice the controls overlap heavily. A tested backup protects you from a failed upgrade and from ransomware. That is why most registers keep IT and cyber together and split them only where ownership differs.

Common IT and Cyber Risks

• Ransomware: malware that encrypts systems or steals data, followed by a demand for payment. It can stop operations for days or weeks.
• Phishing and social engineering: emails, messages or calls that trick staff into giving away passwords, approving payments or opening malicious files. Fake supplier invoices and changed bank details are a common form.
• Third-party and cloud outages: a software provider, hosting company or managed service provider fails or is breached, and your services go down with it.
• Misconfiguration: a cloud storage area left open to the internet, default passwords left in place, or overly broad access rights.
• Insider risk: staff or contractors who misuse access, deliberately or by mistake, such as sending a spreadsheet of client data to the wrong person.
• Unpatched systems: known vulnerabilities left open because updates are delayed or systems are too old to update.
• Data loss: lost or stolen devices, accidental deletion, or backups that turn out not to work when needed.
• Failed changes and projects: a system migration or upgrade that goes wrong and disrupts the business.

How to Assess IT and Cyber Risk

The assessment follows the same logic as any risk assessment. NIST SP 800-30 describes a detailed version; most organisations use a simpler one.

1. Build an asset inventory. List the systems, data, devices and suppliers that matter. You cannot protect what you do not know you have. Note which business process each one supports and who owns it.
2. Identify the threats. For each important asset, ask what could harm it: criminals, mistakes, supplier failure, power loss, a lost device.
3. Identify the vulnerabilities. What weakness would let the threat succeed? Missing multi factor authentication, an unsupported operating system, one administrator with no backup, no tested restore.
4. Note existing controls. Record what is already in place and whether you have evidence it works.
5. Rate likelihood and impact. Use the same five point scale as the rest of the organisation, so cyber risks can be compared with financial or operational ones. Describe impact in business terms: hours of downtime, records exposed, money lost, regulatory action. See how to score likelihood and impact.
6. Evaluate and prioritise. Compare scores with your risk appetite and decide which risks need action first. Rate both before and after controls; the gap between the two shows how much your controls are doing.
7. Record and assign. Put each risk in the risk register with an owner, actions and dates.

Write each risk as cause, event and consequence. "Cyber attack" is too vague to manage. "Because staff log in with passwords only, an attacker could take over an email account and redirect a client payment, causing financial loss and a complaint" tells the owner exactly what to fix.

The Main Frameworks

You do not need to invent your method. Four frameworks cover most needs, and they work together rather than compete.

NIST Cybersecurity Framework (CSF) 2.0

Published by the US National Institute of Standards and Technology on 26 February 2024, CSF 2.0 is designed for any organisation, regardless of size, sector or maturity. It sets out outcomes rather than prescribing how to achieve them. Its core is organised into six functions:

• Govern: strategy, roles, policy, oversight and supply chain risk management. New in version 2.0 and placed at the centre of the framework
• Identify: understand assets, risks and improvement opportunities
• Protect: safeguards such as access control, training and data security
• Detect: find attacks and anomalies
• Respond: act on a detected incident
• Recover: restore systems and operations

CSF 2.0 is a good common language for boards because it is short, outcome based and explicitly links cyber risk to enterprise risk management.

ISO/IEC 27001:2022 and ISO/IEC 27005:2022

ISO/IEC 27001 is the international standard for an information security management system (ISMS), and the one organisations can be certified against. The 2022 edition, published in October 2022, has 93 controls in Annex A grouped into four themes, and was updated by Amendment 1 in 2024. ISO/IEC 27005:2022 gives guidance on the risk management part: how to identify, analyse, evaluate and treat information security risks in a way that meets 27001. ISO/IEC 27002:2022 explains each control in more detail.

CIS Critical Security Controls v8.1

The CIS Controls from the Center for Internet Security are a prioritised set of safeguards against the most common attacks. Version 8.1 is an update to version 8 that revised asset classes and safeguard descriptions and added the Govern function to align with NIST CSF 2.0. They are practical and especially useful for smaller organisations that want to know what to do first.

How they fit together

A common pattern is to use NIST CSF 2.0 to structure the programme and report to the board, ISO/IEC 27001 where clients or contracts ask for certification, and CIS Controls as the practical checklist. All three sit under your general risk framework such as ISO 31000 or COSO ERM. Our risk management frameworks comparison sets them side by side. If you use AI systems, add the guidance in our AI risk management guide.

Key Controls

A small number of controls deal with a large share of common attacks and failures. Most guidance, including the UK NCSC's 10 Steps to Cyber Security, points to the same basics:

Control	Type	Main risks it reduces
Multi factor authentication	Preventive	Phishing, stolen passwords, account takeover
Patch and vulnerability management	Preventive	Unpatched systems, ransomware
Least privilege access and regular access reviews	Preventive and detective	Insider misuse, spread of an attack
Offline or immutable backups, with tested restores	Corrective	Ransomware, data loss, failed changes
Security awareness training and phishing exercises	Preventive	Phishing, payment fraud
Logging and monitoring	Detective	Undetected intrusions, insider misuse
Secure configuration baselines	Preventive	Misconfiguration, default passwords
Supplier due diligence and contract terms	Preventive	Third-party breaches and outages
Incident response and continuity plans, exercised	Corrective	Slow or chaotic response to any incident

A control only counts if it works. Record evidence, such as the access review sign off or the last restore test, and test key controls on a schedule. See our guide to types of risk controls for how preventive, detective and corrective controls work together.

Cyber Key Risk Indicators

Key risk indicators (KRIs) warn you when a risk is growing, before an incident happens. Good cyber KRIs are simple, measurable and have a threshold that triggers action. Examples:

• Percentage of critical patches applied within the target time
• Number of systems running unsupported software
• Percentage of accounts protected by multi factor authentication
• Number of privileged accounts, and access reviews overdue
• Phishing exercise click rate and report rate
• Days since the last successful backup restore test
• Number of critical suppliers without a current security assessment
• Mean time to detect and contain incidents

Set an amber and red threshold for each, agree who acts when it is breached, and track the trend over time. A rising trend is often more useful to the board than a single number.

Reporting Cyber Risk to the Board

Boards do not need a list of vulnerabilities. They need to know whether the organisation's most important services and data are protected well enough, and what decisions they must make. A good cyber section in a board risk report covers:

• The top cyber risks in business terms: what could happen, to which service, and what it would cost or disrupt
• Position against appetite: which risks sit inside appetite and which do not
• KRI trends: a handful of indicators with direction of travel
• Progress on actions: what has been done, what is late and why
• Incidents and near misses: what happened and what was learned
• Decisions needed: investment, risk acceptance or changes in priority

Use plain language, keep the technical detail in an appendix, and use the same scoring scale as the rest of the risk report so cyber is weighed alongside every other risk.

Sample Cyber Risk Register

Here is a short example using a five point scale for likelihood and impact. The scores are illustrative, not benchmarks.

Risk	Cause	L x I	Key controls	KRI	Owner
Ransomware stops core operations	Unpatched servers, flat network, weak remote access	3 x 5 = 15	Patching, network segmentation, immutable backups, tested restores	Critical patches overdue	Head of IT
Payment fraud through a compromised mailbox	Password only logins, no call back check on bank detail changes	4 x 4 = 16	Multi factor authentication, call back procedure, phishing training	Accounts without MFA	Finance Director
Outage at a critical cloud provider	Single provider, no tested exit or failover plan	2 x 4 = 8	Supplier assessment, continuity plan, contract service levels	Critical suppliers not assessed	COO
Client data exposed through misconfiguration	Cloud storage set up without a secure baseline	3 x 4 = 12	Configuration baselines, automated configuration checks, access reviews	Open storage findings	Head of IT
Data misused by an insider	Broad access rights, no monitoring of bulk downloads	2 x 4 = 8	Least privilege, leaver process, data loss alerts	Access reviews overdue	HR Director with IT

Our free risk register template gives you the full set of columns to start from.

Common Mistakes

• Leaving it all to IT: the IT team runs the controls, but the business owns the risk and decides how much of it to accept
• Vague risks: "cyber attack" as a single line, with no cause, asset or consequence
• No asset inventory: assessing risk without knowing which systems and data matter most
• Compliance mistaken for security: a certificate shows a management system exists, not that every control works today
• Untested backups and plans: the first real restore happens during the incident
• Ignoring suppliers: much of your exposure sits in systems you do not run yourself
• Technical board reports: long lists of vulnerabilities that do not lead to a decision

How to Get Started

For a small team, or a consultant helping a client, a useful first version takes a few weeks:

1. List the ten to twenty systems, data sets and suppliers the business cannot run without
2. Name a business owner and a technical owner for each
3. Run one workshop to identify the main risks to those assets, using the list of common risks above
4. Rate each risk on the organisation's existing likelihood and impact scale
5. Check the basics: multi factor authentication, patching, backups with a tested restore, access reviews, training
6. Choose four to six KRIs and set thresholds
7. Map your controls to the six NIST CSF 2.0 functions to spot gaps
8. Add the risks to the main risk register and report the top ones to leadership each quarter

IT and Cyber Risk Management in 2027

The fundamentals stay the same, but several dated developments shape what good practice looks like in 2027:

• Internal audit has a cyber baseline: the IIA's Global Internal Audit Standards have applied since 9 January 2025, its Cybersecurity Topical Requirement took effect on 5 February 2026 and its Third-Party Topical Requirement on 15 September 2026. Expect auditors to test cyber governance, risk assessment and supplier oversight against them
• EU rules are in force: member states had until 17 October 2024 to transpose the NIS2 Directive into national law, and the Digital Operational Resilience Act (DORA) has applied to EU financial entities since 17 January 2025, including oversight of ICT third-party providers
• Disclosure in the US: SEC rules adopted on 26 July 2023 require US registrants to disclose material cybersecurity incidents on Form 8-K, generally within four business days of deciding an incident is material, and to describe their cyber risk management, strategy and governance in their annual report
• Board declarations in the UK: Provision 29 of the UK Corporate Governance Code 2024 asks boards to declare whether material controls, which can include key cyber controls, were effective, for financial years beginning on or after 1 January 2026
• AI joins the attack surface: AI systems bring new risks such as data leakage and manipulated outputs. Under the EU AI Act, as amended by Regulation (EU) 2026/1744, obligations for high risk Annex III systems apply from 2 December 2027

Frequently Asked Questions