Risk Management

Overview

In today’s digitizing world, as organizations are increasingly integrating cyber systems into their operations, they are also facing more diverse, sophisticated threats— cyber, physical, technological, or natural—that may have cross-sector impacts. The evolving risk landscape necessitates an evolved response. 

Risk Management is the process of identifying, analyzing, assessing, and communicating risk and accepting, avoiding, transferring, or controlling it to an acceptable level considering associated costs and benefits of any actions taken. Effective risk management improves the quality of decision making. While risk often cannot be eliminated, actions can usually be taken to control risk. 

CISA’s Role

CISA works with government and industry to identify, analyze, prioritize, and manage the most significant strategic risks to the nation’s critical infrastructure. Since the nation’s critical infrastructure is largely owned and operated by the private sector, managing risk is shared priority. CISA creates an environment where the private sector, government agencies, and key stakeholders can collaborate, share expertise, and coordinate risk reduction activities to ensure critical infrastructure is secure and resilient now and into the future.