Risk Management Programme

What this set does

Most risk registers fail because the methodology behind them is undefined: nobody agreed what 'high' means. This programme fixes the definitions first (likelihood, impact, appetite, tolerance), then supplies the assessment procedure, the register, the treatment plan and the reporting format that follow from those definitions.

What's inside

• Risk management policy and methodology (ISO 27005 and NIST SP 800-30 informed)
• Risk appetite and tolerance statement template
• Risk assessment procedure and worksheet
• Risk register (Excel) with treatment tracking and heat map
• Third-party risk management standard, tiering model and questionnaire
• Board risk report template

Who it is for

Any organisation whose auditor, insurer or customer has asked to see the risk assessment behind the controls.

How the documents are structured

Every document opens with its purpose, scope and owner, then the substantive content, then a control cross-reference showing which framework requirements it satisfies. Standards state requirements in testable language ("must", with the parameter). Procedures follow one format: trigger, roles, steps, frequency, records produced. Placeholders are limited to things only you can know: organisation name (which we fill in), system names, role titles, tool names and timelines. There are no "[insert policy here]" sections.

Tailoring effort

Expect to spend a few hours on a policies-and-standards set and longer on procedures, because procedures describe how your team actually works. The document register in each set lists every file with a suggested owner so you can split the work.

Included in these bundles

• ISO 27001 Certification Bundle — £1,595
• NIST 800-171 & CMMC Level 2 Bundle — £1,995
• NIST CSF 2.0 Governance Bundle — £1,495

Licence

One purchase covers one organisation for internal use, with unlimited users and unlimited edits. Consultancies and MSPs tailoring documents for clients need the multi-client licence; see the terms or ask us.