GCSB-GDL-RMA-001 Risk Management and Assessment Playbook

Document type: Guideline (advisory playbook) Parent procedure: GCSB-PRC-RMA-001 Risk Management and Assessment Procedure Parent standard: GCSB-ST-CSF-RMA-001 Risk Management and Assessment Standard, Version 2.0 Version: 1.0 Status: Issued Approved by: GCSB Governing Council, 19 October 2026 Effective: 19 October 2026 Next review: 19 October 2027 Prepared by: Global Converged Security Board (GCSB)

This playbook is advisory. It explains how to apply GCSB-PRC-RMA-001 in practice. Where this playbook and the parent standard or procedure differ, the standard and procedure prevail.

1. Purpose

The Risk Management standard requires a converged, repeatable method for identifying, analysing, treating and monitoring security risk across cyber, physical and OT domains, with personnel and information concerns embedded across them. The parent procedure fixes the cycles - including the annual risk review and the risk register's role in every major decision. This playbook shows how to run risk management that informs decisions rather than decorating registers, with step-by-step guidance, worked examples, checklists and the records to keep.

The worked examples use the fictional Meridian Logistics Ltd (120 staff, head office, two warehouses, fleet operation), whose board adopted the CSF in March.

2. Guiding principles

• Converged risk, one register. A cyber risk register and a separate physical risk register is exactly the silo thinking the CSF exists to end.
• Risk is about decisions. Every risk entry should exist because someone must decide something: treat, accept, transfer or avoid.
• Scales are servants, not masters. A simple, consistently applied 5x5 scale beats a sophisticated model nobody uses consistently.
• The register is alive. A risk register reviewed once a year is a historical document.

4. Scope and roles

This playbook applies to every organisation adopting GCSB-ST-CSF-RMA-001 through GCSB-PRC-RMA-001. It is advisory throughout: where it differs from the parent standard or procedure, the standard and procedure prevail.

5. Traceability

Play 1 - Establish the risk method (Procedure Steps 1-2)

Objective

Adopt a written, converged risk method: scales, definitions, appetite and roles.

Step by step

1. Define likelihood and impact scales (5x5 recommended) with concrete descriptors per domain - what "major impact" means for people, operations, information and reputation.
2. Draft the risk appetite statement with the governing body: which scores must be treated, which may be accepted, and by whom.
3. Get the appetite approved and written down - unwritten appetite is decided ad hoc under pressure.
4. Name the risk owner for every category; the Enterprise Risk Management Committee (or its equivalent) oversees, individuals own.
5. Approve and publish the method document internally.
6. Calibrate: have two assessors independently score three sample scenarios and compare; adjust descriptors until they land within one band of each other.

Worked example - Meridian Logistics

Meridian's impact scale includes: "Major (4) - serious injury; loss of a warehouse for over a week; customer data of more than 1,000 people exposed; regulatory action; local press coverage." Appetite: scores of 12+ must be treated within 90 days; 8-11 treated or accepted by the sponsor with a date; below 8 may be accepted by the CCSO. Calibration test: the CCSO and the external assessor score "theft of a van from Warehouse South overnight" independently - one scores 12, the other 10; they refine the likelihood descriptor for "likely" and re-score at 12 and 11. Method approved at the May committee.

Checklist

• Scales defined with domain-specific descriptors
• Risk appetite statement approved by the governing body, in writing
• Roles assigned: committee, owners, assessors
• Method document approved and published
• Calibration exercise completed and recorded

Records to keep

• The approved method document (scales, descriptors, appetite)
• The appetite approval minute
• Calibration exercise notes
• Role assignments

Common pitfalls

• Appetite avoidance. Governing bodies often refuse to state appetite because it feels like accepting blame. Without it, every acceptance decision is inconsistent.
• Precision theatre. Heat maps with decimal scores imply accuracy the judgements do not have.

Measures of success

Any two assessors scoring the same scenario land within one band of each other.

Play 2 - Identify and register risks (Procedure Steps 2-4)

Objective

Build the initial converged risk register covering all four domains.

Step by step

1. Plan identification workshops per business area; each workshop examines all four domains: what could harm people, sites, systems and information here?
2. Use three lenses in each workshop: asset-based (what do we protect?), threat-based (who or what threatens it?), scenario-based (what could a bad day look like?).
3. Write each risk as a cause-event-consequence sentence: "Because of [cause], [event] may occur, leading to [consequence]." Reject vague entries ("cyber risk").
4. Facilitate deliberately so quieter domains are heard - the loudest voice (usually IT) must not fill the register.
5. Enter every risk in the register with an owner and a review date at birth.
6. Note convergence opportunities: a single control often treats several risks at once.

Worked example - Meridian Logistics

Four workshops (head office, Warehouse North, Warehouse South, fleet) produce 31 risks. Examples: "Because the Warehouse South roller door interlock is faulty, unauthorised entry may occur during night loading, leading to theft of stock and harm to staff." (physical) "Because the telematics supplier's portal uses shared logins, a former contractor may retain access, leading to disclosure of fleet movements and driver data." (cyber/information) "Because driver reference checks are informal, a driver with a relevant history may be hired, leading to liability and safety incidents." (personnel) Each has an owner and a review date; the register opens on 20 May.

Checklist

• Workshops held for all business areas
• All four domains examined per workshop
• Three lenses used per workshop
• Each risk written as cause-event-consequence
• Every entry has an owner and review date
• Convergence opportunities noted

Records to keep

• Workshop notes and attendance
• The risk register with dated entries
• Rejected/merged entries and why (shows the method was applied)

Common pitfalls

• Workshop dominance. Facilitate deliberately for the quieter domains.
• Register as graveyard. Risks entered once and never revisited. Every entry gets a review date at birth.

Measures of success

The register covers all domains and business areas, and every entry is a treatable sentence with an owner.

Play 3 - Analyse and prioritise (Procedure Steps 3 and 5)

Objective

Score risks consistently and rank them for treatment.

Step by step

1. Score inherent risk first (before controls), then residual risk (with existing controls) - the gap shows what current controls actually buy.
2. Score in facilitated workshops, not alone; group scoring surfaces assumptions.
3. Before crediting a control in the residual score, check it is actually operating.
4. Sanity-check the tail: the top ten risks should be explainable to the governing body in one plain-language sentence each.
5. Give high-impact/low-likelihood risks explicit discussion; do not let them average away.
6. Have the committee review and approve the ranking.

Worked example - Meridian Logistics

The roller-door risk scores inherent 16 (likely 4 x impact 4). The interim measure (night supervisor checks) is verified as actually happening before the residual score drops to 9. The shared-login telematics risk scores inherent 12, residual 12 - no operating control exists. Top risk in plain language for the board: "Someone could walk into Warehouse South at night through the broken door and steal stock or hurt our staff." The committee approves the ranking on 3 June.

Checklist

• Inherent and residual scores recorded per risk
• Scoring done in facilitated sessions
• Controls verified operating before residual credit
• Top risks expressible in plain language
• High-impact/low-likelihood risks explicitly discussed
• Ranking approved by the committee

Records to keep

• Scored register (inherent and residual, with dates)
• Workshop scoring notes
• Control-verification notes supporting residual scores
• Committee approval minute

Common pitfalls

• Control optimism. Residual scores assume controls work perfectly. Check first.
• Averaging away the peaks. A high-impact risk at a middling score still deserves explicit discussion.

Measures of success

A ranked register exists; the committee and governing body agree the top ten.

Play 4 - Treat risks (Procedure Step 6)

Objective

Produce and execute treatment plans for every risk above appetite.

Step by step

1. For each risk above appetite, choose treat / transfer / avoid / accept. Acceptance only within the delegation rules, recorded, with an expiry date.
2. Write treatment plans as actions with owners and dates; link them to the CSF implementation roadmap where they overlap - risk treatment and CSF implementation are the same work seen from two angles.
3. Verify each treatment works before closing the action.
4. Re-score residual risk after treatment and record it.
5. Record every acceptance with the acceptor's name, authority and expiry; review acceptances quarterly.

Worked example - Meridian Logistics

Roller door: treated - interlock repaired (action A14, facilities supervisor, completed 28 June, verified by a night visit), plus a permanent control added (nightly door check logged). Residual re-scored to 4. Telematics shared logins: treated - individual accounts demanded from the supplier (completed July), former contractor access confirmed removed (evidence: supplier confirmation email filed). Driver reference checks: treated - formal two-reference process adopted by HR from August. One acceptance: "Loss of paper archives in the loft by fire" scored 6 - accepted by the CCSO until the digitisation project completes, expiry December, recorded.

Checklist

• Treatment decision recorded for every risk above appetite
• Treatment actions owned, dated and tracked
• Treatments verified working before closure
• Residual scores updated after treatment
• Acceptances recorded with authority and expiry; reviewed quarterly

Records to keep

• Treatment plans and closure evidence
• Verification notes per treatment
• Updated residual scores
• Acceptance records with authority and expiry

Common pitfalls

• Acceptance by inaction. A risk with no treatment plan and no recorded acceptance is not accepted - it is ignored.
• Treatment without verification. Closing a treatment action without checking the control works repeats the cycle next year.

Measures of success

Every above-appetite risk has an executed plan or a properly authorised acceptance.

Play 5 - Monitor, review and report (Procedure Steps 7, 9 and 11; binding clock: annual risk review)

Objective

Keep the register current and the governing body informed.

Step by step

1. Review the register quarterly at the committee: new risks, closed risks, changed scores, overdue treatments.
2. Report top risks and treatment progress to the governing body quarterly, in the same format each time so trends show.
3. Define out-of-cycle triggers: incidents, acquisitions, new sites, new regulations - and use them.
4. Run the binding annual risk review as a full refresh: re-identify, re-score, re-prioritise; feed results into next year's control and budget planning.
5. Minute every review; file every report.

Worked example - Meridian Logistics

The Q4 committee review retires three risks (treated), adds two (a new customer requiring data-sharing; a spate of local van thefts), and flags one overdue treatment (CCTV analytics, re-dated with reason recorded). The annual review the following March re-scores the whole register: overall exposure down 40% year on year (a fictional illustrative figure, not a target); the board uses the result to set next year's security budget. When a nearby warehouse suffers an arson attack in October, an out-of-cycle review adds fire-response risks within a fortnight.

Checklist

• Quarterly committee review of the register, minuted
• Quarterly governing-body risk report in a consistent format
• Out-of-cycle triggers defined and used
• Annual full review completed, minuted, fed into planning and budget
• All outputs filed

Records to keep

• Quarterly review minutes and updated register versions
• Governing-body risk reports
• Out-of-cycle review records
• Annual review report and the planning decisions it drove

Common pitfalls

• Annual-only rhythm. The annual review is the floor, not the ceiling. Quarterly touchpoints keep the register honest.
• Reporting without consequence. If the governing body never acts on the risk report, find out why - wrong detail, wrong forum, or wrong culture.

Measures of success

The register is visibly current at any moment; the annual review changes priorities and budgets.

Play 6 - Integrate risk into decisions (Procedure Steps 8 and 10)

Objective

Make risk assessment a standing input to major decisions, as the standard requires.

Step by step

1. Add a "security risk" section to business cases, project approvals and supplier onboarding templates.
2. For significant decisions, record which register entries were considered.
3. Sample-check decision records quarterly at the committee; challenge template answers like "no significant risks".
4. After incidents, run the lessons-learned loop back into the register: new risks, re-scored risks, failed controls.

Worked example - Meridian Logistics

The business case for the new customer portal includes a security risk section referencing three register entries and adding one new risk (customer data in a new system), which drives two controls into the project plan. After the October arson attack nearby (not at Meridian), the lessons-learned review re-scores fire risks and adds "out-of-hours lone working at warehouses" to the register.

Checklist

• Risk section in decision templates
• Register consideration recorded for major decisions
• Quarterly committee spot-checks of decision records
• Incident lessons fed back into the register

Records to keep

• Decision templates with the risk section
• Major decision records showing register consideration
• Spot-check notes and challenges
• Post-incident register updates

Common pitfalls

• Template tokenism. A risk section everyone fills with "no significant risks" is worse than absent. Sample-check and challenge.

Measures of success

Major decisions routinely reference the register; post-incident reviews change it.

4. Quick reference

5. Related documents

• GCSB-ST-CSF-RMA-001 Risk Management and Assessment Standard, v2.0 (parent standard, sole normative source)
• GCSB-PRC-RMA-001 Risk Management and Assessment Procedure (parent procedure)
• GCSB-ST-CSF-001 Main Standard (annual risk review obligation)

Version 1.0 - issued 19 October 2026. Copyright Global Converged Security Board.