A risk management framework is a structured, repeatable way to identify, assess, treat, and monitor the risks an organisation faces — so decisions about them are deliberate, not accidental.
The major frameworks — NIST RMF, ISO 31000, ISO 27005, COSO ERM, and FAIR — share the same backbone (identify → assess → treat → monitor) but differ in scope, sector, and whether they measure risk qualitatively or in money.
Plain-English explainer · NIST · ISO 31000 / 27005 · COSO · FAIR · Last reviewed June 2026
A risk management framework is a structured, repeatable method for handling risk — identifying what could go wrong, judging how likely and how damaging it is, deciding what to do about it, and keeping that under review as things change. Every credible framework shares the same backbone: identify → assess → treat → monitor. Where they differ is scope (enterprise-wide vs information-security only), origin and sector (US government, ISO, finance), and how they measure risk (qualitative high/medium/low vs quantitative loss in money). The five most common — NIST RMF, ISO 31000, ISO 27005, COSO ERM, and FAIR — are compared below. For most companies pursuing ISO 27001, the relevant one is ISO 27005, the risk method built into an ISMS.
Key Takeaways
- A risk management framework = a repeatable identify → assess → treat → monitor cycle, applied consistently.
- NIST RMF (US gov), ISO 31000 (enterprise-wide guidance), ISO 27005 (infosec, supports ISO 27001), COSO ERM (governance/SOX), FAIR (quantitative, risk in money).
- They’re complementary, not competing — ISO 31000 sets the language, ISO 27005 applies it to security, and FAIR can quantify the output for the board.
- If you’re doing ISO 27001, ISO 27005 is your framework — the risk assessment and treatment plan are mandatory parts of the ISMS.
Four Steps Every Framework Shares
1. Identify
Catalogue assets and the threats and vulnerabilities that could affect them.
2. Assess
Estimate each risk’s likelihood and impact to prioritise what matters most.
3. Treat
Decide to mitigate, transfer, avoid, or accept each risk — and apply controls.
4. Monitor
Review continuously, because risk changes as the business, threats, and controls change.
Five Frameworks, Compared
NIST RMF
A 7-step process (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) from the US NIST. Widely used by US federal agencies and contractors, and pairs with the NIST 800-53 control catalogue.
Best for: US government, federal contractors, and organisations standardising on NIST controls.
ISO 31000
A principles-and-process standard for managing any kind of risk (not just IT) across the whole enterprise. It’s guidance, not a certifiable standard — a common vocabulary and process the others fit inside.
Best for: Enterprise-wide risk management and a common risk language across departments.
ISO 27005
The information-security-specific risk standard that supports ISO 27001. It tells you how to run the risk assessment and treatment your ISMS requires.
Best for: Organisations doing (or planning) ISO 27001 — this is the risk method behind the ISMS.
COSO ERM
A governance-led framework tying risk to strategy and performance, strong on internal control and financial reporting. Common in SOX and finance-heavy organisations.
Best for: Boards, finance, and SOX/internal-control contexts where risk meets strategy.
FAIR
A quantitative model that expresses cyber risk in financial terms (probable loss in money), rather than high/medium/low. Often layered on top of another framework for board-level reporting.
Best for: Quantifying cyber risk in rupees/dollars for executive and board decisions.
Which One Do You Need?
- Pursuing ISO 27001 → ISO 27005 (it’s the risk method your ISMS requires).
- Want one risk language across the whole company → ISO 31000.
- US government / federal contracts → NIST RMF with NIST 800-53.
- Board, finance, or SOX focus → COSO ERM.
- Need to express cyber risk in money for executives → add FAIR on top.
Risk Management Frameworks — Common Questions
The questions people ask most when picking a risk framework.
What is a risk management framework?
What are the main risk management frameworks?
Which risk framework should I use for ISO 27001?
Is NIST RMF the same as ISO 31000?
Qualitative or quantitative risk assessment — what’s the difference?
Related reading: the Learn hub, what GRC is, what an ISMS is, and our ISO 27001 guide. More terms in the compliance glossary.
Related Reading
ISO 27001 Knowledge Hub
All 93 Annex A controls, all clauses, every guide in the cluster.
Read moreISO 27001 Requirements
Clauses 4–10 and the 93 Annex A controls, explained.
Read moreISO 27001 Overview
The ISMS standard — the baseline certificate global buyers ask for.
Read moreAnnex A Controls Overview
All 93 controls across organizational, people, physical and tech domains.
Read moreAI Risk Assessment
Risk identification, impact analysis and treatment for AI systems.
Read moreSoA Builder
Draft an ISO 27001 Statement of Applicability across all 93 controls.
Read more