Cyber risks are removed from the risk register or other artifact used to document and manage identified risks when they no longer require tracking or response

Once analysis by risk management stakeholders indicates that the realization of a cyber risk is no longer likely or the impact is not material, the risk should be removed from the risk register or other artifact that is used to document and manage identified risks. A defined process for removing risks should be followed that includes archiving analysis information and any lessons learned information that could be leveraged in the management of similar cyber risks in the future. Cyber risk categories that no longer serve a purpose in the risk management process should also be removed. As the organization remediates the causes of risks, some cyber risk categories may become unnecessary or redundant. Removing cyber risk categories and cyber risks once eliminated or impact is not material will help the organization more efficiently manage remaining risks. For example, the organization may remove a cyber risk related to an operating system if that operating system is no longer in use within the organization.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: RISK-2d, RISK-2e, RISK-2f, RISK-2i, RISK-2j, RISK-2k, RISK-2l, RISK-3f.