Skip to main content
Cyber Risk Council
Category: Risk Management

Risk Framing

Also known as: Framing Risk
Simply put

Risk framing is the foundational step in managing risk where an organization defines the assumptions, constraints, risk tolerances, and priorities that will guide how it handles risk. It sets the ground rules and shared understanding before any specific risks are assessed or addressed. In practice, it is most effective when done at the organizational level with input from stakeholders across the business.

Formal definition

Per NIST, risk framing is the set of assumptions, constraints, risk tolerances, and priorities/trade-offs that shape an organization's approach for managing risk. It establishes the risk management context and produces a risk management strategy that governs subsequent risk assessment, response, and monitoring activities. NIST guidance (SP 800-53 PM-28) indicates risk framing is most effective when conducted at the organization level and in consultation with stakeholders throughout the organization, including mission and business owners. Note that the security-management sense of risk framing described here is distinct from the behavioral 'framing effect,' which concerns how the presentation or wording of information influences choices and perceptions.

Why it matters

Risk framing is the step that gives every subsequent risk activity its meaning. Without a shared set of assumptions, constraints, risk tolerances, and priorities, an organization's risk assessments become inconsistent, its risk responses become arbitrary, and its monitoring lacks a benchmark against which to judge whether risk is being kept within acceptable bounds. Framing establishes the ground rules and common understanding before specific risks are identified and evaluated, which is why NIST positions it as foundational to managing risk.

The value of risk framing depends heavily on organizational context and stakeholder cooperation. NIST guidance indicates that framing is most effective when conducted at the organization level and in consultation with stakeholders throughout the organization, including mission and business owners. When framing is done in a silo, or treated as a purely technical exercise, the resulting risk management strategy often fails to reflect actual business priorities and trade-offs, leaving security decisions disconnected from the organization's mission and appetite for risk.

It is worth noting that the security-management sense of risk framing is distinct from the behavioral framing effect, which concerns how the presentation or wording of information influences choices and perceptions. Conflating the two can lead to confusion; in the risk management context, framing refers to setting the strategic context for managing risk, not to how information is presented to influence a decision.

Who it's relevant to

Executives and Business Owners
Because risk framing captures risk tolerances, priorities, and trade-offs, it depends on input from those who own the organization's mission and business objectives. NIST guidance emphasizes consultation with mission and business owners, since legal and organizational accountability for risk decisions typically remains with the organization and its officers rather than with any advisor.
Security Leaders and Virtual CISOs
A virtual or fractional CISO often facilitates risk framing as part of strategy and governance work, helping the organization articulate assumptions, constraints, and tolerances at the organizational level. The vCISO advises and directs this process, but the resulting risk management strategy and its decisions belong to the client organization. The effectiveness of this facilitation depends on access to stakeholders and organizational cooperation.
Risk and Compliance Teams
Risk framing establishes the context that governs subsequent risk assessment, response, and monitoring. Teams responsible for these activities rely on a clearly framed risk management strategy to keep their work consistent and aligned with the organization's stated tolerances and priorities.

Inside Risk Framing

Risk Assumptions
The explicit statements about threats, vulnerabilities, consequences, and likelihood that an organization uses as the starting point for assessing risk. In a virtual CISO engagement, these assumptions are typically surfaced collaboratively with client stakeholders to reflect the organization's actual environment rather than generic industry defaults.
Risk Constraints
The boundaries within which risk decisions must be made, such as budget, regulatory obligations, contractual commitments, staffing, and technology limitations. A vCISO helps document these constraints so risk decisions remain realistic and defensible, though the constraints themselves are set by the client organization.
Risk Tolerance and Appetite
The level of risk the organization is willing to accept in pursuit of its objectives. A virtual CISO advises on articulating tolerance and appetite, but the decision on how much risk to accept remains with client officers and leadership, since accountability for those decisions typically stays with the organization.
Priorities and Trade-offs
The relative importance the organization places on different missions, functions, assets, and outcomes, used to guide where limited security resources are focused. Framing these trade-offs is a governance and business risk activity, not a purely technical one.
Scope of the Risk Environment
The definition of what parts of the organization, systems, data, and stakeholder relationships are being considered when framing risk. Clarifying scope early helps set expectations about what a given engagement type will and will not address.

Common questions

Answers to the questions practitioners most commonly ask about Risk Framing.

Is risk framing the same as performing a risk assessment?
No. Risk framing precedes and shapes a risk assessment rather than replacing it. Framing establishes the context, boundaries, assumptions, risk tolerance, and priorities that determine how an organization will identify and evaluate risk. The assessment is the subsequent activity of actually identifying, analyzing, and estimating specific risks within that established context. Treating them as interchangeable is a common mistake, since skipping the framing step often leads to assessments that measure the wrong things or apply inconsistent criteria.
Does a virtual CISO decide the organization's risk appetite when framing risk?
Typically no. A virtual CISO usually facilitates and advises on risk framing, but the underlying risk appetite and tolerance decisions generally remain with the client organization and its officers, who hold the business and legal accountability for those choices. The vCISO can structure the conversation, present trade-offs, translate technical exposure into business terms, and recommend positions, but the authoritative decision on how much risk to accept usually rests with leadership. Framing that is not validated by accountable stakeholders often produces guidance that does not reflect the organization's actual priorities.
How does a virtual CISO typically begin a risk framing engagement?
In many engagements, the vCISO begins by gathering context: the organization's business objectives, regulatory environment, existing security posture, prior incidents, and stakeholder concerns. This often includes interviews with leadership and key functions to understand what the organization values, what it fears losing, and what constraints apply. The output is usually a documented set of assumptions, scope boundaries, risk tolerance statements, and priorities that will guide subsequent assessment work. The depth of this step often varies by organizational maturity and the access the vCISO is granted to stakeholders.
What inputs are needed for effective risk framing?
Effective risk framing typically depends on inputs such as business objectives and priorities, applicable regulatory and contractual obligations, the organization's stated risk tolerance, an understanding of critical assets and processes, threat context relevant to the organization, and any relevant history of incidents or audit findings. Access to accountable stakeholders is often essential, since framing reflects business judgment rather than a purely technical exercise. Where these inputs are incomplete or stakeholders are unavailable, the resulting frame may be provisional and require revision as more context becomes available.
How does risk framing relate to frameworks such as the NIST CSF or ISO 27001?
Risk framing often draws on frameworks to provide structure and common language, but the frameworks do not replace the framing decisions specific to the organization. For example, a framework may describe categories of risk or governance functions, while framing determines how the organization interprets and prioritizes those elements given its context and tolerance. A vCISO may use such frameworks to support consistency and readiness, but framing itself does not assert compliance or certification; it establishes the context within which control selection and assessment against a framework later occur.
How often should risk framing be revisited?
Risk framing is generally not a one-time activity. It is often revisited when significant changes occur, such as shifts in business strategy, new regulatory obligations, major technology changes, mergers or acquisitions, or material incidents that alter the organization's understanding of its exposure. Some organizations also review framing on a periodic cadence tied to governance cycles. The appropriate frequency may vary by organizational maturity, rate of change, and the terms of the engagement, and revisiting framing depends on continued client cooperation and access to decision-makers.

Common misconceptions

Risk framing is a technical exercise that a virtual CISO performs independently using scanning tools and assessments.
Risk framing is primarily a governance and business risk activity that depends on organizational assumptions, constraints, and tolerance. It requires input from client leadership and stakeholders; a vCISO facilitates and structures the process but cannot meaningfully frame risk without client cooperation and access to decision-makers.
Once a virtual CISO frames the organization's risk, the vCISO becomes accountable for the risk decisions that follow.
A virtual CISO advises on and helps document risk framing, but legal and organizational accountability for accepting, transferring, or mitigating risk generally remains with the client organization and its officers unless a contract specifies otherwise.
Risk framing produces a fixed output that guarantees the organization is protected against breaches.
Risk framing establishes the assumptions, constraints, tolerance, and priorities that guide subsequent risk work; it does not guarantee any security outcome. Its value depends on organizational maturity, defined scope, and ongoing revisiting as conditions change.

Best practices

Establish risk assumptions, constraints, tolerance, and priorities collaboratively with client stakeholders rather than importing generic industry defaults that may not reflect the organization's actual environment.
Document the scope of the risk environment explicitly at the start of the engagement so both the vCISO and client share expectations about what is and is not being addressed.
Confirm in writing that accountability for risk decisions remains with the client organization and its officers, while the virtual CISO's role is to advise, structure, and direct.
Secure access to the decision-makers and stakeholders whose input is required, since the quality of risk framing depends on client cooperation and organizational maturity.
Revisit risk framing periodically as business objectives, constraints, and the threat environment change, rather than treating it as a one-time deliverable.
Tie risk framing to the organization's business priorities and trade-offs so that subsequent security work reflects governance and risk considerations, not only technical concerns.