Risk Management

Overview

In today’s highly connected world, organizations all face more diverse, sophisticated threats—cyber, physical, technological, or natural—that have cross-sector impacts. The evolving risk landscape necessitates an evolved response. 

Risk Management is the process of identifying, analyzing, assessing, and communicating risk and accepting, avoiding, transferring, or mitigating it to an acceptable level considering associated costs and benefits of any actions taken. Effective risk management improves the quality of decision making. While risk cannot always be eliminated, actions can be taken to mitigate risk.

CISA's Role

CISA’s National Risk Management Center (NRMC) works with government and industry to identify, analyze, prioritize, and manage the most significant strategic risks to the nation’s 16 critical infrastructure sectors. Since the nation’s critical infrastructure is largely owned and operated by the private sector, managing risk is shared priority. The NRMC facilitates collaboration, coordination and analysis across the private sector, government agencies, and key stakeholders to ensure critical infrastructure is secure and resilient now and in the future.