Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Risk Management
  4. >Risk Management - Objective 3
  5. >C2M2-RISK-3E
C2M2-RISK-3EActive

Organizational stakeholders from appropriate operations and business functions participate in the analysis of higher priority cyber risks

Statement

Organizational stakeholders from appropriate operations and business functions participate in the analysis of higher priority cyber risks

Location

Domain
Risk Management
Objective
Risk Management - Objective 3

Practice Details

Identifier
C2M2-RISK-3E
Domain
Risk Management
Objective
Objective 3
Maturity Level
MIL-2

Help Text

Organizational stakeholders from appropriate areas of the organization are necessary for comprehensive analysis of prioritized cyber risk categories and cyber risks. Specific stakeholders may be more appropriate for analyzing certain cyber risks or cyber risk categories and provide insight that cannot be gained from others in the organization. Additionally, stakeholders from various parts of the organization will provide different perspectives that will help gain a full understanding of risks and potential mitigations.

Related Practices · Input From: Implementing RISK-3a provides input that may be useful for implementing this practice. · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: RISK-3c, RISK-3d, RISK-3e.

AESCSF
AESCSF-RISK-3eequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Risk Management - Objective 3
Risk Management - Objective 37 controls
C2M2-RISK-3ACyber risks are prioritized based on estimated impact, at least in an ad hoc mannerC2M2-RISK-3BDefined criteria are used to prioritize cyber risks (for example, impact to the organization, impact to the community, likelihood, susceptibility, risk tolerance)C2M2-RISK-3CA defined method is used to estimate impact for higher priority cyber risks (for example, comparison to actual events, risk quantification)C2M2-RISK-3DDefined methods are used to analyze higher priority cyber risks (for example, analyzing the prevalence of types of attacks to estimate likelihood, using the results of controls assessments to estimate susceptibility)C2M2-RISK-3EOrganizational stakeholders from appropriate operations and business functions participate in the analysis of higher priority cyber risksC2M2-RISK-3FCyber risks are removed from the risk register or other artifact used to document and manage identified risks when they no longer require tracking or responseC2M2-RISK-3GCyber risk analyses are updated periodically and according to defined triggers, such as system changes, external events, and information from other model domains