Cyber risks are removed from the risk register or other artifact used to document and manage identified risks when they no longer require tracking or response
Context and Guidance: Once analysis by risk management stakeholders indicates that the realisation of a cyber risk is no longer likely or the impact is not material, the risk should be removed from the risk register or other artifact that is used to document and manage identified risks. A defined process for removing risks should be followed that includes archiving analysis information and any lessons learned information that could be leveraged in the management of similar cyber risks in the future. Cyber risk categories that no longer serve a purpose in the risk management process should also be removed. As the organisation remediates the causes of risks, some cyber risk categories may become unnecessary or redundant. Removing cyber risk categories and cyber risks once eliminated or impact is not material will help the organisation more efficiently manage remaining risks. For example, the organisation may remove a cyber risk related to an operating system if that operating system is no longer in use within the organisation.
Related Practices • Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: RISK-2d, RISK-2e, RISK-2f, RISK-2i, RISK-2j, RISK-2k, RISK-2l, RISK-3f.