Identify 2.2.5 Risk management strategy Determine the priorities, constraints and maximum risk tolerances of your organisation. On this basis, assess your operational risks. Description Task ID.RM-1 Establish risk management processes, manage them actively and have them confirmed by the persons/stakeholders concerned. ID.RM-2 Define and communicate your organisation›s maximum risk tolerance. ID.RM-3 Ensure that maximum risk tolerance is calculated taking into account your organisation’s importance as an operator of a critical infrastructure. This calculation should also be informed by sector-specific risk analyses. Table 11: ID.RM tasks Standard Reference COBIT 5 APO12.04, APO12.05, APO13.02, BAI02.03, BAI04.02, APO12.06 ISA 62443-3:2013 4.3.4.2, 4.3.2.6.5 ISO 27001:2013 NIST-SP-800-53 Rev. 4 PM-8, PM-9, PM-11, SA-14 Table 12: ID.RM references Minimum ICT standard 2018 19