5.5 — Risk monitoring framework
Workshop 5.5: set up the mechanism that keeps the analysis alive — indicators, governance, roles and steering committee.
Risk management must rely on steering indicators to check the effectiveness of the measures taken, their adaptation to the evolving threat, and to track the implementation of the treatment plan over time.
"Steering indicators" tab
An indicator carries: name, type, measurement frequency, owner (CISO, CIO…), target value (≥ 90%, 0 incidents…), status, description of the measurement method, and notes (data sources, collection method).
Indicators can be entered by hand or selected from the library of indicators, with search and multi-select.
"Governance & continuous improvement" tab
| Section | Content |
|---|---|
| Continuous improvement | Objectives of the approach and description of the process: periodic review, updating the analysis, PDCA cycle, conditions that trigger a new analysis |
| Organisation and governance | Structure in place, reporting lines, integration into existing governance |
| Roles and responsibilities | Role / function, actor or entity, responsibilities |
| Steering committee | Meeting frequency and notes (members, typical agenda, arrangements) |
Recommended committee frequency
Every six months during ramp-up, then every twelve months at cruising speed. Quarterly (enhanced monitoring) and Ad hoc / event-driven options are also available.
This deliverable is part of the report
Unlike measure deployment tracking — which is operational execution and would date the document — the 5.5 monitoring framework is exported into the Word report. It is a workshop deliverable: it describes the mechanism, not its progress.
Undo/redo
History is active on this page: Ctrl+Z undoes the last change to an indicator or role.