The risk management disciplines described in the preceding sections of this publication address risk at the level of individual assets, processes, and systems within the ISMS scope. Portfolio risk management extends this governance perspective to the level of the security programme’s collection of projects, initiatives, and ongoing activities viewed as an integrated whole, recognising that the aggregate risk profile of the portfolio as a system may be materially different from the sum of its individual components’ risk assessments. The ISO who governs only at the individual risk level without examining the portfolio-level dynamics that connect security initiatives, create interdependencies, and produce cumulative exposures that no single risk assessment captures is governing with a risk perspective that is accurate within its scope but incomplete at the level of strategic governance that the board and executive management require.
Portfolio risk management is a governance discipline that the ISO must understand in two related but distinct senses. The first is the management of risk across the security programme’s portfolio of delivery initiatives, ensuring that the collective risk profile of the programme’s projects and activities is understood, governed, and aligned with the organisation’s risk appetite. The second is the contribution that portfolio-level thinking makes to the governance of the organisation’s information security risk landscape more broadly, recognising that systemic risks affecting multiple initiatives simultaneously and the interdependencies between security investments require governance attention at a level above individual risk assessment.
Understanding Portfolio-Level Risk #
The distinction between individual project or risk-level management and portfolio-level management is one of governance perspective and analytical scope. Individual risk assessments examine specific threats to specific assets or processes. Portfolio risk management examines the cumulative impact of multiple risks and initiatives on the organisation’s capacity to achieve its strategic security objectives, the interdependencies between initiatives that mean the failure of one affects the delivery capability of others, and the resource constraints that determine how much risk the portfolio as a whole can accommodate simultaneously without exceeding the organisation’s management and response capacity.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
