1.6.3 Risk management 1.6.3.3 Risk analysis 1.6.3.1 Risk management programme The scope that the ICT risk analysis should cover should be defined clearly. The business processes that are affected and the technical elements concerned must be described along with possible external factors. Their weighting within the analysis should also be defined. These factors then determine the content and boundaries of the analysis. Before any defence-in-depth strategy can be implemented, the business risks to an organisation that are associated with cyber threats must be understood. These risks must be managed in accordance with the appetite for risk across the business as a whole. Those responsible for managing and maintaining ICT systems must be able to recognise, assess and address cyber risks. To do this, they must understand how these methods must be applied to their particular system landscape. This in turn requires a clear understanding of threat scenarios, operational and technical processes, and the technologies used. Only then can a defence-in-depth strategy be integrated in to normal day-to-day business. Management is responsible for ensuring a secure environment as fundamental to all computer-based activities within the organisation. The principles for handling risk that are described above also apply in general. A number of ICT applications are nonetheless especially important owing to their criticality. These include industrial control systems (ICS) in particular. Designing an effective ICS security architecture demands that business risks be placed in relation to the functional (operational) requirements of the ICS. This may also relate to the physical world, such as perimeter defences around data centres. Decision-makers at all levels of the organisation must be aware of the importance of cyber risks and must play an active role in the risk management process. It is essential that selected systems, applications and processes, including the associated networks, are subject to regular risk analyses. Set strict specifications for these analyses, and take a structured and systematic approach. 1.6.3.2 Risk management framework ICT risk analyses should be embedded in a risk management framework and conducted regularly on clearly defined subjects. Examples of scope include business-critical facilities, processes and applications (including those currently in development), as well as their dependencies on further systems, networks and services. The objective of this risk management framework is to allocate the risks that are identified to responsible individuals or functions, who/which then monitor and assess them and take appropriate action to keep them within the limits that have previously been defined as acceptable (=risk appetite). 1.6.4 Business impact analysis A business impact analysis should identify the potential realistic and the potential worst-case impacts (on business operations) of ICT components (incl. individuals, data, processes, services and networks) being compromised. This should cover a range of areas, such as finance, operations, legal affairs, reputation and health. Ultimately, the business must determine what effects on its operations it is willing to bear if the necessary ICT assets are not available as planned. Thus, the requirements and defence levels necessary to ensure the availability, integrity and usability of the identified ICT resources, as determined by acceptable risk, must be defined. 1.6.5 Action Action to counter the risks described in the business impact analysis should be identified, reviewed, and approved. It should be released together with the plans for the exact steps that senior management will take. Attention should also be paid here to establishing the residual risk to all assets in their relevant environments, and to dealing with that risk appropriately (e.g. mitigation, avoidance, transfer or acceptance) in line with the business’s risk appetite. In this way, the maximum permitted risk should be determined for each individual asset, so that (cumulated) ICT risks can be calculated. 1.6.6 Cybersecurity architecture Cybersecurity architecture encompasses the specific measures taken and their strategic placement within the network to establish a layer of security in the sense of the defence-in-depth strategy. It should also permit information to be gathered on the data flow between all systems and their connections. The cybersecurity architecture should also be aligned with the physical inventory of facilities and ICT assets, to ensure an holistic understanding of the flows of information within the organisation. Minimum ICT standard 2018 9