Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When should a key risk indicator be escalated, and to whom?

7 decision pointsThe pack behind this answer: Cybersecurity Metrics & Reporting Programme

Add to board memo

The short answer

Recommendation
Escalate a key risk indicator when its checked value enters amber or red, counting from the day it is validated. Amber goes to the owner of the linked risk, red to executive management, and if the review or reassessment puts the risk past tolerance, the board or its equivalent is told out of cycle.
Reasoning
A key risk indicator is only useful if everyone knows, before the number arrives, what value means trouble and who must hear about it. The zone is a warning, not a verdict: it prompts a review of the linked risk and never changes the risk's rating by itself. Times count from validation, so a value that has not passed its quality checks has no zone yet. An indicator that stays amber shows the risk is not coming back, so after a run of amber periods it is escalated as red, unless an approved treatment plan is on schedule and the risk owner has recorded that for the period.
Considerations
  • The times are the CISO Times metrics pack's defaults in working days from validation: amber to the risk owner in 5, red to executive management in 2, review in 10, the board in 5 after a reassessment past tolerance; 3 amber periods count as red. Owners may escalate sooner.
  • Only that body may accept a risk past tolerance: the board, or a board risk committee it has delegated to (its chair is told); the management board in a two-tier structure; executive management where there is no board.
  • If you cannot confirm last period's escalation was made, or the reassessment result is not yet clear, take the cautious branch.
  • A rolling counting window can hold one burst of events in amber for several periods. Say whether anything new happened.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA key risk indicator has a new value for the periodDecisionHas the value passed its quality checks?OutcomeNo zone yet: check the value firstDecisionWhich zone does the validated value fall in?OutcomeGreen: no escalation, report at the normal cadenceDecisionIs this its 3rd amber period in a row, or later?DecisionIs the risk's approved treatment plan on schedule, recorded?OutcomeNot escalated as red: report amber with the plan's statusDecisionWas it amber last period too, and escalated then?DecisionWas it red last period too, and escalated then?OutcomeNo new escalation: report it with the owner's commentStepTell the risk owner; they review the riskStepTell executive management and reassess the riskDecisionDoes the review or reassessment put the risk past tolerance?OutcomeTell the board or its equivalent out of cycleOutcomeResult and a dated plan go to the next executive committee

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 16 steps.

  1. Start

    A key risk indicator has a new value for the period

    A key risk indicator is only useful if everyone knows, before the number arrives, what value means trouble and who must hear about it. The zone is a warning, not a verdict: it prompts a review of the linked risk and never changes the risk's rating by itself. Only a reassessment in the risk register does that.

    In the pack

  2. Decision

    Has the value passed its quality checks?

    A value is set to a zone only after its inputs pass the completeness, freshness and plausibility checks, run by someone other than the supplier. Escalation times count from the date of validation, never from the date someone notices the number. A figure that fails is corrected, reported with a printed caveat, or withheld.

    In the pack

    See also

  3. Outcome

    No zone yet: check the value first

    Until the value is validated there is no zone and the clock has not started. A value that is withheld has no zone for that period. In the pack's default, a withheld period neither ends a run of amber periods nor adds to it. An owner may always escalate sooner.

    In the pack

    See also

  4. Decision

    Which zone does the validated value fall in?

    Check red first: a value at or past the red threshold is red, even if it also passes amber. A value exactly at a threshold is in the zone that threshold opens. Whether higher or lower is better is on the indicator's card. Where the risk's category has no amber zone, the indicator goes from green straight to red.

    In the pack

  5. Outcome

    Green: no escalation, report at the normal cadence

    No one is told beyond the normal report. The owner comments only on a change of direction. A return to green ends any run of amber periods, and a later amber starts a new count.

    In the pack

  6. Decision

    Is this its 3rd amber period in a row, or later?

    Staying amber is not standing still: it shows the risk is not coming back. The pack's default is 3 periods in a row, counted on validated values in the indicator's own reporting periods. A rolling window can hold one burst of events in amber for several periods, so say whether anything new happened.

    In the pack

  7. Decision

    Is the risk's approved treatment plan on schedule, recorded?

    The carve-out applies only when the plan has at least one open action, every open action is before its due date and not reported at risk, and the risk owner records this beside the value each period. No record means no carve-out. A slipped action, refused funding or approval, or a finished plan with the indicator still amber all remove it.

    In the pack

  8. Outcome

    Not escalated as red: report amber with the plan's status

    A risk being brought back within appetite can keep its indicator amber for as long as the treatment takes. Report the value as amber, with the risk owner's record that the plan is on schedule. The executive committee should see the plans themselves, because a record made without looking at the plan defeats the carve-out.

    In the pack

  9. Decision

    Was it amber last period too, and escalated then?

    Escalation is for a KRI that enters amber. Once the owner has reviewed the risk and the result and a plan have gone to the executive committee, the KRI is reported at its normal cadence with the owner's comment until it returns to green. If you cannot confirm last period's escalation was made, treat this as a new one.

    In the pack

  10. Decision

    Was it red last period too, and escalated then?

    Escalation is for a KRI that enters red, and a move from amber to red is a red escalation in its own right. A KRI already escalated as red stays red until its value falls below the red threshold, and is reported at its normal cadence with the owner's comment. If you cannot confirm last period's escalation was made, treat this as a new one.

    In the pack

  11. Outcome

    No new escalation: report it with the owner's comment

    The escalation already made stands. Report the value at the normal cadence with the owner's comment, and say whether anything new happened, because a rolling count can hold old events for several periods. The owner may always escalate sooner. An amber KRI still counts towards the persistence rule.

    In the pack

  12. Step

    Tell the risk owner; they review the risk

    Amber means the linked risk may have moved above appetite. In the pack's defaults, tell the owner of the linked risk within 5 working days of validation. The owner then reviews the risk within 10 working days of validation, because a breach is a trigger to reassess. Record the escalation in your escalation log with the three dates: validated, told, reviewed.

    In the pack

    See also

  13. Step

    Tell executive management and reassess the risk

    Red means the linked risk may be past tolerance. So does amber escalated under the persistence rule, though its zone is still reported as amber. In the pack's defaults, executive management is told within 2 working days of validation, through the Head of Information Security. The risk is reassessed within 10 working days of validation. Log it with its dates.

    In the pack

    See also

  14. Decision

    Does the review or reassessment put the risk past tolerance?

    Only the review or reassessment moves the risk, and it may keep the rating: in the pack's amber example, the owner's review kept the risk within appetite. Wherever a reassessment puts a risk past tolerance, the board or its equivalent is told. If the result is unclear or not yet agreed, take the cautious branch and treat the risk as past tolerance.

    In the pack

  15. Outcome

    Tell the board or its equivalent out of cycle

    In the pack's default, within 5 working days of the reassessment, without waiting for the next meeting. Who that is depends on how you are governed: the board, or a board risk committee it has delegated to (its chair is told); the management board in a two-tier structure; executive management where there is no board. Only that body may accept the risk. The result and a dated plan still go to the executive committee.

    In the pack

    See also

  16. Outcome

    Result and a dated plan go to the next executive committee

    The escalation is complete when the review or reassessment result, and a plan with a date, have gone to the executive committee. Record what the committee decided. The indicator is then reported at its normal cadence, with the owner's comment, until it returns to green. A red indicator stays red until its value falls below the red threshold.

    In the pack

    See also

Practical checklist

  1. Once the value passes its quality checks, place it in a zone, checking red first. For green, report at the normal cadence.
  2. For amber entered this period, tell the owner of the linked risk, who reviews the risk.
  3. For a 3rd amber period in a row, check whether the treatment plan is on schedule and recorded. If not, escalate as red.
  4. For red entered this period, tell executive management through the Head of Information Security, and reassess the linked risk.
  5. If the review or reassessment puts the risk past tolerance, tell the board or its equivalent out of cycle.
  6. Send the result and a dated plan to the next executive committee, and record what it decided.
  7. Log each escalation with the dates it was validated, told and reviewed.

Evidence to have ready

  • The escalation log: indicator, period, value and zone, the linked risk and its owner, and the validated, told and reviewed dates.
  • The review or reassessment result, with the residual rating and the reason.
  • The risk owner's record each period of whether the treatment plan was on schedule, where it held an indicator back.
  • The executive committee's decision on each escalation, and any out-of-cycle note to the board or its equivalent.

Assumptions

  • Each key risk indicator is linked to one risk in your risk register, or to all top risks, and has green, amber and red thresholds set from that risk's appetite and tolerance and approved by its owner.
  • The times shown are the defaults in the CISO Times metrics pack, in working days from validation. Your own procedure may set different ones. An owner may always escalate sooner.
  • The top decider depends on how you are governed: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board.

Not covered here