How to write your risk assessment methodology under NIS 2

What does the law ask for?

Art. 21(2)(a) NIS 2 lists “policies on risk analysis and information system security” among the measures every essential and important entity takes. In Germany, § 30(2) Nr. 1 BSIG transposes this as “Konzepte in Bezug auf die Risikoanalyse und auf die Sicherheit in der Informationstechnik”.

Neither text prescribes a form, a length or a method. The measures must be appropriate, proportionate and effective, and you document that you meet the duty (§ 30(1) sentence 3 BSIG). What is proportionate depends on your exposure to risks, your size, the cost of implementation, and how likely and how severe incidents are, including their societal and economic impact (Art. 21(1) NIS 2, § 30(1) sentence 2 BSIG).

The methodology is where that documentation starts. It shows how you find, rate and treat risks, so that the ratings in your risk register can be traced back to rules someone responsible has approved.

Art. 21(1) and (2)(a) NIS 2 · § 30(1) and (2) Nr. 1 BSIG

What does the methodology have to answer?

Commission Implementing Regulation (EU) 2024/2690 spells it out most precisely. Point 2.1.2 of its annex asks for a risk management methodology, a risk tolerance level in line with the company's risk appetite, and risk criteria that are set and kept up to date.

Then come the working steps. Identify and document the risks on an all-hazards basis, in particular those involving third parties and those that could disrupt availability, integrity, authenticity or confidentiality, single points of failure included. Analyse each risk by threat, likelihood, impact and risk level, using what you know about cyber threats and vulnerabilities. Evaluate it against your criteria and choose how to treat it.

Finally, the follow-through: monitor the treatment, name who is responsible for each measure and by when, and record the measures in a risk treatment plan with the reasons for accepting any residual risk “in a comprehensible manner”.

The regulation binds only the entity types it names, such as DNS service providers, cloud computing service providers, data centre service providers and managed service providers (its Art. 1; for Germany § 30(3) BSIG). For every other company it is not binding. It is still the most complete list of what a methodology has to answer, so it makes a good checklist for yours.

CIR (EU) 2024/2690, Art. 1 and Annex point 2.1.2 · § 30(3) BSIG

A scale everyone applies the same way

The core of the methodology is the scale. BSI Standard 200-3, the risk analysis method of Germany's Federal Office for Information Security, rates every risk on two dimensions: how often it can happen and how big the damage would be. It recommends qualitative categories over figures, because the statistics for a precise calculation are usually missing, and no more than five categories per dimension.

As an example, the BSI uses four levels each. Frequency: rare (at most every five years), medium (every five years to once a year), frequent (once a year to once a month), very frequent (several times a month). Damage: negligible, limited, considerable, threatening the existence of the organisation. A matrix combines both into four risk levels, from low to very high. The BSI states that the matrix only illustrates its examples and should be adapted to your own needs, and that every organisation may set both the number of levels and the criteria itself.

Whatever scale you choose, define each level in words your staff recognise and agree the definitions with the departments that will use them. The BSI's test is a good one to write into your own document: if two employees rate the same risk, they should reach the same result.

Keep the method and the results apart. The methodology says how you rate. The risk register holds what you rated. The register changes often; the methodology should stay stable.

BSI Standard 200-3, chapter 5

How detailed should it be?

As detailed as your company needs. The proportionality test applies to the methodology like any other measure. A firm with one site and a few systems does not need the apparatus of a group with many subsidiaries.

A good sign the methodology is too large: no one outside the person who wrote it can apply it. A good sign it is too small: it has no defined levels, so every rating is a judgement call that cannot be repeated.

A skeleton to write from

Below is an outline you can copy into your own document. Each heading carries one sentence of example wording, using the BSI's example categories. Replace the bracketed parts with your own facts and adapt the levels if they do not fit your company.

1. Purpose and scope
   This methodology sets how [company] identifies, rates and treats risks to the network and information systems it uses for its services.

2. Roles
   [Role] runs the assessment. [Management] approves this methodology and accepts residual risks from level [high] up.

3. Frequency
   Rare: at most every five years. Medium: every five years to once a year. Frequent: once a year to once a month. Very frequent: several times a month.

4. Damage
   Negligible, limited, considerable, threatening the existence of [company], each defined as follows: [definitions in your terms, for example downtime, cost, data affected].

5. Risk levels and tolerance
   The matrix in annex [x] gives each risk a level from low to very high. Risks rated [medium] or above are treated. Low risks are accepted, recorded and watched.

6. Identifying risks
   We consider all hazards, including supplier failures, fire, water, power cuts and single points of failure, not only attacks.

7. Treating risks
   For each risk above tolerance we decide to reduce, transfer, avoid or accept it, and record who does what by when.

8. Accepting residual risk
   [Management] accepts what remains, in writing, with the reason and the date.

9. Review
   We repeat the assessment once a year and after any significant incident or significant change.

Who approves it, and who accepts residual risk?

Art. 20(1) NIS 2 has the management bodies approve the cybersecurity risk-management measures and oversee their implementation. The German text in § 38(1) BSIG puts it as a duty to implement the measures and oversee their implementation. In practice, management signs off the methodology and sees the results of each assessment.

For the entities under Regulation (EU) 2024/2690, point 2.1.1 adds that risk assessment results and residual risks are accepted by the management bodies, or by persons who are accountable for risk management and have the authority to manage risks, provided management is adequately informed. It is a sound rule for any company: a residual risk that no named person has accepted belongs to no one.

The BSI's description of its four risk levels gives a sense of practice: low risks are commonly accepted while the threat is kept under watch, and very high risks are rarely accepted.

Art. 20(1) NIS 2 · § 38(1) BSIG · CIR 2.1.1 · BSI Standard 200-3, table 10

When do you revisit it?

NIS 2 and the BSIG set no interval. For the entity types under Regulation (EU) 2024/2690, point 2.1.4 requires the assessment results and the treatment plan to be reviewed at planned intervals and at least annually, and when operations or risks change significantly or a significant incident occurs.

For every other company we suggest the same two triggers: a fixed date once a year, and any significant change or incident in between. Write both into the methodology, so the next review does not depend on someone remembering it.

CIR 2.1.4

Common mistakes

Levels without definitions. If “high” means whatever the person rating it feels that day, ratings cannot be compared from one person or one year to the next.

Only attacks and only IT. The all-hazards approach includes fire, water, power cuts, the failure of a supplier, and the one person who alone knows how a system works.

Treatment without an owner and a date. A measure nobody is named for does not get done.

Residual risk nobody accepted. The register lists it, but no one with the authority to accept it has done so.

Written once for a project and never reopened. After the first change in your systems or suppliers, an unreviewed methodology and register describe a company that no longer exists.