Key Risk Indicator Threshold & Escalation Model
Sets green, amber and red thresholds for each KRI and the escalation each breach triggers against risk appetite.
Available soon
- Format
- Word
- Size
- 67 KB
- Length
- 20 pages
- Version
- 1.1
- Updated
What's inside
- Purpose
- The rules
- Principles
- Inputs
- The three zones
- Setting thresholds
- Escalation
- The key risk indicators in the catalogue
- Worked examples
- How this model connects to risk management and board reporting
- How to defend the model to an auditor
- Limitations
- Calibration and review
- Related documents
- Adapting this template
- Framework references
- Definitions
What changed
- 1.1
MC-35 shows the ordering platform's monthly restore check (P10 EA-04): 0 of 4.
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
Purpose
A key risk indicator (KRI) is only useful if everyone knows, before the number arrives, what value means trouble and who must hear about it. This model sets that in advance for [[Organisation Name]]. It turns the appetite and tolerance the board has set for each category of risk into green, amber and red thresholds for every KRI, and it says who is told, within what time, when a KRI crosses one.
It applies to every metric of type KRI in the Security KPI & KRI Catalogue. There are 7 in the catalogue as published, each linked to one risk in the Information Security Risk Register, or to all top risks. Key performance indicators (KPIs) are judged against a target instead, and are not covered here.
The model sits between two packs. The risk scale, the bands and the appetite levels are the Risk Assessment Methodology & Scoring Model's. The three zones use the position words of the Board Reporting Narrative Model, so a KRI, a risk and the board report describe the same exposure in the same words. A zone never moves a risk on its own: only a reassessment in the risk register does that.
Guidance — delete before approval
Adopt this model once your risk register and appetite statement are approved. Without an approved appetite and tolerance for each category, a KRI has nothing to be judged against, and its thresholds are opinions.
The numbers in [[double brackets]] are template defaults. Change them here and on each KRI's definition card together (MR-09).
The rules
These are the rules of the Security Metric Definition & Measurement Method that this model applies. Every other document in the pack quotes them by number.
MR-07 Every KPI must have a target, and every KRI green, amber and red thresholds. A KRI's thresholds are set from the appetite and tolerance of the risk it indicates (P05) and approved by that risk's owner.
MR-08 A KRI that enters amber or red must be escalated as the escalation table sets, counting from the date its value is validated. A KRI amber for [[3]] periods in a row is escalated as red, unless its linked risk has an approved treatment plan that is on schedule (P05 RM-06, RM-07), recorded by the risk owner each period. If the plan slips, the KRI is escalated as red.
MR-09 A change to a metric's definition, source or thresholds must be recorded on its card with the date. Earlier values are restated on the new basis, or the break is marked and no trend is drawn across it.
MR-12 Every value must be shown with its target or thresholds, its direction since the last period and its status in words (P03 BR-04). Never colour alone, never a combined index, and never a score out of 100.
MR-05 also applies: a KRI value is set to a zone only after its inputs have passed the completeness, freshness and plausibility checks. A value that was withheld has no zone for that period.
Principles
Most questions about why a KRI is in the zone it is in are answered by one of these.
- Thresholds come from appetite, not from history. A threshold is the value at which the linked risk would sit above appetite or past tolerance. Last year's average says what is normal, not what is acceptable.
- The zone is a warning, not a verdict. Amber says the linked risk may have moved above appetite. The risk owner then reviews it and decides. The zone never changes the risk's rating by itself.
- The same words everywhere. Each zone is written with the position it stands for, and the colour always sits beside the words (MR-12).
- The clock starts when the value is checked. Escalation times count from the date the value is validated, never from the date someone notices it. An owner may always escalate sooner.
- A breach is a trigger. A KRI entering amber or red means a control may not be working as the risk assessment assumed. That is one of P05's reassessment triggers, so the linked risk is looked at again within the time P05 sets.
- Staying amber is not standing still. A KRI that stays amber for several periods shows that the risk is not coming back. The persistence rule escalates it as red, unless an approved treatment plan on schedule explains why it is still amber.
Inputs
The metric owner gathers these before thresholds are set, with the risk owner.
Input | Question it answers | Where it comes from |
|---|---|---|
The linked risk | Which risk does this indicator give early warning of? | The Information Security Risk Register: the risk's scenario, owner and residual impact and likelihood |
The risk's category and appetite level | How much of this kind of risk has the board accepted? | The Cyber Risk Appetite Statement Template |
The KRI's definition card | What exactly is counted, from which source, and which way is better? | The Metric Definition Card Template |
What the risk assessment assumed | Which level of this indicator is already built into the current likelihood and impact ratings? | The reasons recorded with the risk's ratings |
Recent values | Where has the indicator been, and how much does it move from period to period? | The Metrics Data Collection & Quality Workbook and the Operational Security Metrics Dashboard |
Guidance — delete before approval
Recent values help to set the plausibility checks on the card and to spot a threshold that would trip every month. They do not set the thresholds: appetite does.
The three zones
A KRI's value falls in one of three zones. Each says what the value suggests about the linked risk, in the words the board report uses for a risk's position.
Zone | Written as | Stands for the position | Meaning |
|---|---|---|---|
Green | Green: consistent with the risk within appetite | Within appetite | The indicator is where the risk owner expects it while the linked risk is within appetite. |
Amber | Amber: the risk may be above appetite | Outside appetite, within tolerance | The indicator is at a level at which the linked risk may have moved above appetite. The risk owner reviews it. |
Red | Red: the risk may be past tolerance | Outside tolerance | The indicator is at a level at which the linked risk may have moved past tolerance. Executive management is told and the risk is reassessed. |
How a value is placed:
- A value at a threshold is in the zone that threshold opens. With an amber threshold of 2, a value of 2 is amber.
- For a KRI where lower is better, the zone rises as the value rises. Where higher is better, it rises as the value falls. The card says which (the 'Better when' field).
- Red is checked first. A value at or past the red threshold is red, even if it also passes amber.
- Where there is no amber threshold, the KRI goes from green straight to red.
Setting thresholds
The method
MR-07 sets where thresholds come from: the appetite and tolerance of the linked risk. The steps:
- Start from the linked risk in the risk register: its residual impact and likelihood, and its category's appetite level (P05).
- Ask the risk owner: at what value of this indicator would you score the likelihood one step higher? At what value would you also score the impact higher?
- Work out the residual score each answer would give, and its position against appetite and tolerance (P05).
- The amber threshold is the first value at which the position would be Outside appetite, within tolerance. The red threshold is the first value at which it would be Outside tolerance.
- Where the category's appetite and tolerance are the same band (the Open level), there is no amber zone: the KRI goes from green to red.
- Where the linked risk is already outside appetite, the KRI starts in amber. Green is then the treatment's target, and red still marks tolerance.
- The risk owner approves the thresholds, and they are written on the card with the reasoning. They are reviewed whenever the appetite statement changes (MR-09).
The zones each appetite level allows
A category's appetite level decides which residual bands count as green, amber and red. This follows from P05's bands (Low 1–3; Medium 4–6; High 8–9; Critical 12–16) and its position rule.
Appetite level | Appetite / tolerance | Green: residual band | Amber: residual band | Red: residual band |
|---|---|---|---|---|
Averse | Low / Medium | Low | Medium | High, Critical |
Cautious | Medium / High | Low, Medium | High | Critical |
Open | High / High | Low, Medium, High | None: no amber zone | Critical |
So for a risk in a Cautious category now rated Medium, the amber threshold is the value at which the owner would rate it High, and the red threshold the value at which they would rate it Critical. For an Averse category the zones sit one band lower.
Where the linked risk already sits
Linked risk now | The KRI starts in | Green then means | Red still means |
|---|---|---|---|
Within appetite | Green | Consistent with the risk as assessed | The risk may be past tolerance |
Outside appetite, within tolerance | Amber | The treatment has worked: its target | The risk may be past tolerance |
Outside tolerance | Red | Not reachable until the risk is treated | Already reported past tolerance; the KRI shows whether it is getting worse. Only the board or its equivalent may accept the risk |
Writing the thresholds on the card
- The amber and red values, with the unit and which way is better.
- The linked risk, and the residual score each threshold stands for, with the reasoning in a sentence or two.
- The risk owner's approval and its date (MR-07).
- The date of the appetite statement the thresholds were set from. When the appetite statement changes, the thresholds are reviewed and any change is logged on the card (MR-09).
Guidance — delete before approval
If the risk owner cannot say at what value they would rate the risk higher, the indicator probably does not track that risk. Choose another indicator, or record the KRI as a KPI with a target until it can be tied to a risk.
Do not set a threshold so that the KRI is green today. Set it where the risk would move, and let today's value fall where it falls.
Escalation
What each zone triggers
A KRI that enters amber or red must be escalated as the escalation table sets, counting from the date its value is validated. A KRI amber for [[3]] periods in a row is escalated as red, unless its linked risk has an approved treatment plan that is on schedule (P05 RM-06, RM-07), recorded by the risk owner each period. If the plan slips, the KRI is escalated as red. Each zone triggers the following. Times are working days from the date the value is validated.
Zone | Who is told | Within | Then |
|---|---|---|---|
Green | No one beyond the normal report | — | Reported at the normal cadence. The owner comments only on a change of direction. |
Amber | The owner of the linked risk | 5 working days | The risk owner reviews the linked risk within 10 working days of validation (P05 RM-10). The KRI, the review's result and a plan with a date go to the next executive committee. |
Red | Executive management, through the Head of Information Security | 2 working days | The linked risk is reassessed within 10 working days of validation (P05 RM-10). If the reassessment puts it past tolerance, the board or its equivalent is told within 5 working days, out of cycle (P03), and only the board or its equivalent may accept it (P05). |
A KRI entering amber or red is also a reassessment trigger under P05 ("A control that has failed, or is found not to work as the assessment assumed"), which is why the review or reassessment runs to P05's time of 10 working days (RM-10).
Who decides past tolerance
If the reassessment puts the linked risk past tolerance, only the board or its equivalent may accept it, and it is told within 5 working days, out of cycle, as the Board Reporting Narrative Model requires. Who that is depends on how the organisation is governed: the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management.
Guidance — delete before approval
Name the top decider for your structure in the definition cards and in this model, for example "[[the Board Risk Committee]]". Where the board has delegated to a committee, the committee chair is the person told out of cycle.
The persistence rule
A KRI amber for [[3]] periods in a row is escalated as red, unless its linked risk has an approved treatment plan that is on schedule (P05 RM-06, RM-07), recorded by the risk owner each period (MR-08). Escalated as red means the red row applies: executive management is told within 2 working days and the linked risk is reassessed. The zone itself stays amber, and is reported as amber.
- Periods are the KRI's reporting periods, counted on validated values.
- [[A period whose value was withheld neither ends a run of amber periods nor adds to it]].
- A return to green ends the run. A later amber starts a new count.
- A move from amber to red is a red escalation in its own right, whatever the run.
When a treatment plan holds the KRI back
A risk that is being brought back within appetite can keep its KRI amber for as long as the treatment takes. The carve-out stops the persistence rule escalating a plan that is working as agreed:
- On schedule. The treatment plan has at least one open action, and every open action is before its due date and not reported at risk by its owner. The plan is the one approved under P05's treatment rules (RM-06, RM-07).
- Recorded each period. Each period the risk owner records, beside the KRI's value, whether the plan is on schedule and why. No record means the carve-out does not apply.
- Slipped. An open action passes its due date or is reported at risk, or the plan's funding or approval is refused. The KRI is then escalated as red in that period.
- Finished. A plan whose actions are all done no longer holds the KRI back. If the KRI is still amber, the treatment has not worked, and the persistence rule applies.
Guidance — delete before approval
The default of [[3]] periods suits a monthly KRI. For a KRI counted over a rolling window, one burst of events can hold it in amber for as long as the window lasts. Check the window against the persistence period when you set the thresholds, and say on the card what the owner should look for (see 'Limitations').
Recording an escalation
Each escalation is recorded in the escalation log with an ID, so the Executive Committee Security Report Deck can show it and the programme measure MC-39 (KRI escalations made on time) can count it:
Field | What to record |
|---|---|
Escalation ID | ESC-YYYY-MM-nn |
KRI, period, value and zone | As validated |
Linked risk and its owner | From the card |
Validated, told, reviewed | The three dates, so the times can be checked |
Review or reassessment result | The residual rating after review, with the reason |
Executive committee | The meeting it went to and what the committee decided |
Action | What, who, by when |
An escalation is complete when the result of the review or reassessment, and the plan with a date, have gone to the executive committee. The KRI is then reported at its normal cadence, with the owner's comment, until it returns to green.
The key risk indicators in the catalogue
Every KRI in the Security KPI & KRI Catalogue, the risk it indicates and where it starts, for the EXAMPLE firm as at 30 Sep 2026. The EXAMPLE sets thresholds for MC-20, MC-34 and MC-35; the others are set by the adopter with each risk owner.
KRI (owning pack) | Linked risk | Category and appetite; risk now | Starts in | EXAMPLE thresholds | EXAMPLE value |
|---|---|---|---|---|---|
MC-04 Overdue exposure (P01) | R-05 Critical weaknesses on internet-facing systems exploited before they are fixed | Service availability: Cautious Medium, within appetite | Green | [[Set with the risk owner]] | No EXAMPLE value |
MC-08 Unmitigated SoD conflicts (P02) | R-02 Payment fraud through a compromised supplier email account | Financial fraud: Cautious High, outside appetite, within tolerance | Amber | [[Set with the risk owner]] | No EXAMPLE value |
MC-13 Risks outside appetite and past tolerance (P05) | All top risks | 2 of 12 outside appetite | Amber | Set by the position rule: amber when any top risk is outside appetite, red when any is past tolerance | 2 of 12 top risks outside appetite; 0 past tolerance Amber |
MC-20 Concentration (P06) | R-06 Managed IT provider fails or is compromised | Third-party dependency: Cautious Low, within appetite | Green | Amber 8, red 10 providers | 6 providers (SUP-001, SUP-002, SUP-004, SUP-006, SUP-011, SUP-014) Green |
MC-23 Access that should not have existed (P07) | R-07 Administrator misuses privileged access | People and insider: Cautious Low, within appetite | Green | [[Set with the risk owner]] | No EXAMPLE value |
MC-34 Phishing compromises (P11) | R-09 Staff account taken over through phishing | People and insider: Cautious Medium, within appetite | Green | Amber 2, red 4 incidents in 3 months | 2 in 3 months (INC-2026-014, INC-2026-017) Amber |
MC-35 Critical systems without a checked restore (P11) | R-10 Backups cannot restore a critical system | Service availability: Cautious Medium, within appetite | Green | Amber 2, red 3 critical systems | 0 of 4 Green |
- MC-13 counts risk positions, so its zones are the position rule itself: "Outside tolerance if any top risk is past its own tolerance limit; otherwise Outside appetite, within tolerance if any top risk is above appetite; otherwise Within appetite."
- MC-08 starts in amber, because its linked risk R-02 is already outside appetite. Its green threshold is the treatment's target. The owner of R-02 records its plan each period: TA-02 due 30 Nov 2026, in progress. On schedule, so MC-08 is not escalated as red however long it stays amber, until the plan slips or finishes (MR-08).
- The EXAMPLE gives a value only where the other packs' facts give one. MC-04 and MC-08 come from packs whose examples describe other organisations; MC-23 is left for your own figures.
Worked examples
The examples use the EXAMPLE firm that runs through the pack: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its September 2026 reporting cycle is as at 30 Sep 2026. Replace it with your own.
Example 1 — setting the thresholds for MC-34
Step | MC-34 Phishing compromises |
|---|---|
Definition (card) | Incidents in the last 3 calendar months whose root cause was a phishing email: an account taken over, or malware run from an attachment or link. Counted from the incident case log by the date detected. |
Linked risk | R-09 Staff account taken over through phishing. Owner: HR Director. |
Category and appetite | RC-06 People and insider: Cautious. Appetite Medium, tolerance High. |
Risk as assessed | Residual 2 Moderate × 3 Likely = 6, Medium: within appetite. |
The owner's answers | One phishing compromise a quarter is what R-09's likelihood (Likely: has happened to us, and the gap is still open) already assumes. Two in three months means attempts are getting through with little in the way: likelihood Almost certain. Four means the owner would expect one to lose data or money: impact one step higher as well. |
Thresholds | Amber at 2 incidents in 3 months; red at 4. Lower is better. |
Approved | By the HR Director, as owner of R-09 (MR-07), with the reasoning written on the card. |
Each threshold, scored on P05's matrix:
Rung | Rating it stands for | Band | Position | KRI value | Zone |
|---|---|---|---|---|---|
As assessed now | 2 Moderate × 3 Likely = 6 | Medium | Within appetite | Below 2 | Green |
Likelihood one step higher | 2 Moderate × 4 Almost certain = 8 | High | Outside appetite, within tolerance | 2 or more | Amber |
Likelihood and impact one step higher | 3 Major × 4 Almost certain = 12 | Critical | Outside tolerance | 4 or more | Red |
Example 2 — MC-34 goes amber in September
The monthly values, from the incident case log. Each counts phishing compromises detected in the three months to the month end.
Month end | Value | Zone |
|---|---|---|
31 Jul 2026 | 0 | Green |
31 Aug 2026 | 1 | Green |
30 Sep 2026 | 2 | Amber |
The two compromises are INC-2026-014, "Ransomware on 14 office PCs at Warehouse 2", detected 12 Aug 2026, and INC-2026-017, "Staff mailbox taken over after a phishing email", detected 22 Sep 2026. In September 2026 the value reached 2, the amber threshold.
When | What happened | Rule and time allowed |
|---|---|---|
7 Oct 2026 | Value validated at step 2 of the monthly cycle: 2 in 3 months (INC-2026-014, INC-2026-017). Zone: Amber. | MR-05; the clock starts (MR-08) |
7 Oct 2026 | The HR Director, owner of R-09, told (0 working days after validation). | Amber: within 5 working days, by 14 Oct 2026 |
13 Oct 2026 | R-09 reviewed (4 working days after validation). Both compromises were found by the monitoring provider and contained within hours: INC-2026-017 in 40 minutes, with no mail taken. Likelihood stays at Likely, as long as the second-factor gap INC-2026-017 used is closed by the date below. Residual stays 2 Moderate × 3 Likely = 6, Medium: within appetite. | P05 RM-10: within 10 working days, by 21 Oct 2026 |
14 Oct 2026 | Executive committee. Noted the amber KRI and the owner's review. Agreed the action below, and that the KRI is reported monthly until it returns to green. | The next executive committee |
30 Nov 2026 | Action due: replace text-message codes with an authenticator app for every staff account that can sign in from outside the office. Owner: Head of IT. | The plan with a date |
Recorded as ESC-2026-09-01. Both times were met. The review finished on 13 Oct 2026, after the month's report was sent, so the programme measure MC-39 counts it one cycle in arrears: October's report will read 1 of 1. September's report reads "None due", because no KRI was escalated in August. The review kept R-09 within appetite, so the board picture does not change: 2 of 12 top risks outside appetite; 0 past tolerance.
The committee's one-sentence answer that month: "We are outside our cyber risk appetite on 2 of 12 top risks, both within tolerance. One early warning moved to amber this month: two phishing compromises in three months. The owner of R-09 reviewed it and kept it within appetite, with one action agreed today."
Example 3 — what red would have required
Had the same validation on 7 Oct 2026 found a value of 4 or more, the red row would have applied:
By | What | Rule |
|---|---|---|
9 Oct 2026 | Executive management told, through the Head of Information Security | Red: within 2 working days |
21 Oct 2026 | R-09 reassessed by its owner | P05 RM-10: within 10 working days |
28 Oct 2026 at the latest | If the reassessment puts R-09 past tolerance: the board or its equivalent told out of cycle, and only the board or its equivalent may accept it | P03 out-of-cycle report: within 5 working days of the reassessment |
If the reassessment kept the risk within tolerance, the result and the plan would go to the next executive committee, as for amber, and the KRI would stay red until its value fell below the red threshold.
Example 4 — the persistence rule
The count looks back three months, so each compromise stays in it for three month ends. If no further compromise is detected:
Month end | Value | Zone | Amber periods in a row |
|---|---|---|---|
31 Jul 2026 | 0 | Green | — |
31 Aug 2026 | 1 | Green | — |
30 Sep 2026 | 2 | Amber | 1 |
31 Oct 2026 | 2 | Amber | 2 |
30 Nov 2026 | 1 | Green | — |
31 Dec 2026 | 0 | Green | — |
MC-34 is amber for 2 periods and returns to green at the end of November. The persistence rule is not met.
Now suppose one more compromise is detected on 16 Nov 2026 (a hypothetical case, not part of the EXAMPLE):
Month end | Value | Zone | Amber periods in a row |
|---|---|---|---|
31 Jul 2026 | 0 | Green | — |
31 Aug 2026 | 1 | Green | — |
30 Sep 2026 | 2 | Amber | 1 |
31 Oct 2026 | 2 | Amber | 2 |
30 Nov 2026 | 2 | Amber | 3 |
31 Dec 2026 | 1 | Green | — |
The value never reaches 4, but the November value is the third amber period in a row. Does the carve-out hold it back? R-09's treatment plan has one action, the one agreed after ESC-2026-09-01: replace text-message codes with an authenticator app for every staff account that can sign in from outside the office, due 30 Nov 2026. November's value is validated on 7 Dec 2026, after that date. If the action is done, the plan is finished and no longer holds the KRI back: the treatment has not brought compromises down. If it is not done, the plan has slipped. Either way the KRI is escalated as red: executive management is told within 2 working days of validation and R-09 is reassessed. The report still shows the zone as amber, with the words "escalated as red under MR-08".
Guidance — delete before approval
MC-34 counts a rolling three months, so each compromise stays in the count for three month ends. Two compromises in one month could hold it amber for [[3]] periods in a row with no new event, and meet the persistence rule on old news. When you escalate it, say whether any new compromise occurred.
Example 5 — the position KRI
MC-13 counts top risks by position. As at 30 Sep 2026: 2 of 12 top risks outside appetite; 0 past tolerance (was 3, last quarter). Its zone is Amber, the same as the board measure BM-01, because R-01 and R-02 are outside appetite with treatment plans. If a reassessment put any top risk past tolerance, MC-13 would go red that period, and the out-of-cycle report to the board or its equivalent would follow within 5 working days.
MC-13 has been amber at every month end since the first monthly cycle (3, 3, 2 top risks outside appetite in July, August and September), so September is its third amber period in a row. It is not escalated as red, because each risk owner recorded on 7 Oct 2026 that the treatment plan is on schedule:
Linked risk | Owner | Plan as recorded | On schedule |
|---|---|---|---|
R-01 Ransomware takes online ordering offline for more than 2 days | Chief Operating Officer | Treatment decision Reduce, approved by the Chief Operating Officer (RM-06). TA-01 due 15 Dec 2026, awaiting board approval: its funding goes to the board on 29 Oct 2026, as the plan sets. | Yes |
R-02 Payment fraud through a compromised supplier email account | Chief Financial Officer | Treatment decision Reduce, approved by the Chief Financial Officer (RM-06). TA-02 due 30 Nov 2026, in progress. | Yes |
Guidance — delete before approval
The record is the check. If TA-01 or TA-02 slipped past a due date, or the board refused the funding on 29 Oct 2026, MC-13 would be escalated as red in that period. Make the check with the risks' treatment plans in the Risk Treatment Plan; it is the same check the committee makes on its 'Risks outside appetite' slide.
How this model connects to risk management and board reporting
Three packs describe the same exposure. The table shows where each idea lives.
Idea | This model (P11) | Risk management (P05, Risk Assessment Methodology & Scoring Model) | Board reporting (P03, Board Reporting Narrative Model) |
|---|---|---|---|
Scale | Thresholds stand for residual scores on P05's scale | 4 × 4 impact × likelihood; four bands | Likelihood words that match P05's |
Words | Green: Within appetite Amber: Outside appetite, within tolerance Red: Outside tolerance | A risk's position against its category's appetite and tolerance (RM-05) | The organisation's position across the top risks (BM-01) |
What moves a risk | Nothing. A zone is a warning | A reassessment (RM-10) | The register's count |
What a breach triggers | Escalation by zone (MR-08) | A reassessment within the RM-10 time | Out of cycle to the board or its equivalent if past tolerance |
Who decides past tolerance | The board or its equivalent | The board or its equivalent | The board or its equivalent |
How to defend the model to an auditor
An auditor will usually test that what is monitored and measured is decided, with methods that give valid results and a set time and person to analyse them (ISO/IEC 27001 clause 9.1), and that the organisation acts on risks as its risk criteria say (clause 6.1.1). Financial entities will also be asked to show key risk metrics set within an approved risk tolerance (DORA Article 6(8)(b) and (c)).
Evidence to have ready
- This model, approved, and the appetite statement its thresholds were set from.
- For each KRI, its definition card: thresholds, linked risk, reasoning, the risk owner's approval and the change log (Metric Definition Card Template).
- The escalation log for the last [[12]] months, with validated, told and reviewed dates.
- The executive committee papers that received each escalation (Executive Committee Security Report Deck), with the decisions.
- MC-39 (KRI escalations made on time) for each month.
- The calibration record (see 'Calibration and review').
The re-derivation test
Invite the auditor to pick [[5]] KRIs. For each, take the linked risk's current rating and the appetite level of its category, and work out the band each threshold stands for from the 'Setting thresholds' section. Then take any month's validated value and place it in its zone. Each result should match the card and the report, and each escalation should be in the log within its time. Run this test yourself each quarter.
Questions auditors commonly ask
Question | Answer the model gives |
|---|---|
Why these thresholds? | Each is the value at which the risk owner would rate the linked risk above appetite (amber) or past tolerance (red), scored on the risk matrix and written on the card with the reasoning. |
Who approved them? | The owner of the linked risk (MR-07). The appetite and tolerance they come from are approved by the board. |
How do you know breaches are escalated? | Every escalation is logged with its dates, and MC-39 reports the share made on time each month. |
What if a KRI stays amber? | After [[3]] periods it is escalated as red, unless its linked risk's approved treatment plan is on schedule, as the risk owner records each period (MR-08). |
Can the thresholds be changed to make a KRI green? | Only by the risk owner, with a reason on the card and the change logged (MR-09). A change made after a breach is reported with the breach. |
How does a KRI relate to the risk register? | A breach is a reassessment trigger. The register changes only when the reassessment changes the rating. |
Limitations
No threshold model is complete. These are this one's known weaknesses, and how they are managed.
Limitation | Effect | How it is managed |
|---|---|---|
Thresholds are the owner's judgement. | Two owners could set different thresholds for the same indicator. | The reasoning is written on the card; calibration compares owners' answers each year. |
The risk scale is coarse. | A threshold marks a step between bands, so a small change in value can move a zone. | The zone only prompts a review. The rating changes only through reassessment. |
Rolling windows hold events. | A count over the last three months keeps each event for three periods. MC-34 is one: two compromises in one month can hold it amber for the whole window and meet the persistence rule with no new event. | The owner says in the escalation whether new events occurred. The executive committee sees the monthly values, not only the zone. |
Lagging indicators warn late. | A count of incidents moves only after harm is done. | Pair each lagging KRI with a leading one where possible, such as a KRI on the control the incidents get past. |
A KRI covers one risk at a time. | Several amber KRIs on one service can matter more than any one shows. | The executive committee sees every KRI outside green together on one slide. |
KRIs stay amber while plans run. | MC-13 and a KRI whose risk is already outside appetite stay amber until the treatment is done, and would meet the persistence rule every few months. | The carve-out (MR-08): no escalation as red while the plan is on schedule, recorded by the risk owner each period. A record made without looking at the plan defeats it, so the committee sees the plans on its 'Risks outside appetite' slide. |
Calibration and review
Calibration between risk owners
- Before first use, and every year after, give two risk owners the same [[3]] KRIs and their linked risks, and ask each the two questions of the method independently.
- Compare their thresholds. A difference that changes the zone of a recent value shows a question that needs clearer wording or an example.
- Change the wording here, not in the owners' heads, and record the change below.
- Run the test cases below on any spreadsheet or dashboard that sets zones, including the collection workbook and the dashboard. Each must give the expected zone.
Zone test cases
Case | Value | Amber | Red | Better when | Expected zone | What it tests |
|---|---|---|---|---|---|---|
1 | 1 | 2 | 4 | Lower | Green | Below the amber threshold |
2 | 2 | 2 | 4 | Lower | Amber | A value at the amber threshold is amber |
3 | 3 | 2 | 4 | Lower | Amber | Between the thresholds |
4 | 4 | 2 | 4 | Lower | Red | A value at the red threshold is red |
5 | 3 | None | 4 | Lower | Green | Open level: no amber zone, green up to red |
6 | 0.96 | 0.95 | 0.9 | Higher | Green | Higher is better: above the amber threshold |
7 | 0.93 | 0.95 | 0.9 | Higher | Amber | Higher is better: below amber, above red |
8 | 0.9 | 0.95 | 0.9 | Higher | Red | Higher is better: at the red threshold |
Every quarter
The Head of Information Security checks the following with the quarterly board cycle and records the result. The signals are prompts to investigate, not targets.
Check | Signal that the model needs attention |
|---|---|
Re-derivation test | Any card whose thresholds cannot be reproduced from the linked risk and the appetite level. |
Zones over the quarter | A KRI amber or red every month without a change in its risk, or one that has never left green in [[4]] quarters while incidents occurred on its risk. |
Escalations | Any escalation outside its time (MC-39 below target), or one made without a result recorded. |
Persistence | The same KRI escalated as red under the persistence rule twice in a row. |
Incidents | An incident on a risk whose KRI was green in the period before it. |
Review
This model is reviewed at least every 12 months, and also when the appetite statement changes, after a significant incident on a risk that has a KRI, or when the quarterly checks show the same signal twice. The review is approved by executive management. Changes to thresholds are made on each card, by the risk owner (MR-07, MR-09).
Calibration record
Date | Risk owners | KRIs compared | Zone differences | Change made | Approved by |
|---|---|---|---|---|---|
[[YYYY-MM-DD]] | [[Names]] | [[n]] | [[n]] | [[None / description]] | [[Name]] |
Related documents
Document | Relationship |
|---|---|
Security Metric Definition & Measurement Method | The rules MR-01 to MR-12 this model applies |
Security KPI & KRI Catalogue | Lists every KRI with its linked risk |
Metric Definition Card Template | Where each KRI's thresholds, reasoning, approval and change log are written |
Metrics Data Collection & Quality Workbook | Where values are checked before a zone is set (MR-05) |
Operational Security Metrics Dashboard | Shows every KRI's zone and direction each month |
Executive Committee Security Report Deck | Shows KRIs outside green and their escalations to the executive committee |
Metric Ownership Responsibility Matrix | Names who interprets each KRI and starts its escalation |
Risk Assessment Methodology & Scoring Model | The risk scale, bands, appetite levels and position rule the thresholds stand for |
Cyber Risk Appetite Statement Template | The appetite and tolerance each threshold is set from |
Information Security Risk Register | The linked risks and their current ratings |
Board Reporting Narrative Model | The position words and the out-of-cycle report to the board |
Adapting this template
Guidance — delete before approval
Small organisation: start with [[3]] to [[5]] KRIs on the top risks, not one for every risk. Keep the method, the zones and the escalation table: they are what an auditor tests. In a firm of [[20]], the Head of Information Security role may be the IT manager or an external adviser, and executive management the owners; name real people on each card.
Regulated entity (NIS2, DORA): a financial entity's digital operational resilience strategy must set the ICT risk tolerance and key risk metrics (DORA Article 6(8)(b) and (c)), with the tolerance approved by the management body (Article 5(2)(d)). Keep this model, the cards and the escalation log together as that evidence. For an entity under NIS2, the Implementing Regulation (EU) 2024/2690 Annex point 7.2 shows what a regulator expects: what is measured, how, when and by whom. It binds the digital providers it names, and is a useful guide for others.
IT run by a service provider: the provider often supplies a KRI's inputs, but thresholds and escalation stay with your risk owners. Put the supply deadline and the extract date in the contract or service schedule, and have the provider tell your metric owner the same day it sees a value past a threshold.
If your organisation already has an enterprise KRI framework, use its zone names only if they mean the same as these. Otherwise map them here, and keep one set of words in every report.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA).
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Clause 6.1.1 — General | Setting thresholds: KRIs tied to the risk criteria and to action on risks |
ISO/IEC 27001:2022 | Clause 9.1 — Monitoring, measurement, analysis and evaluation | The whole model: what is measured, how it is judged, and who analyses it |
NIST CSF 2.0 | GV.RM-02 — “Risk appetite and risk tolerance statements are established, communicated, and maintained” | Setting thresholds: appetite and tolerance statements turned into KRI thresholds |
NIST CSF 2.0 | GV.RM-05 — “Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties” | Escalation: who is told, within what time |
NIST CSF 2.0 | GV.OV-03 — “Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed” | Calibration and review; escalations reported to the executive committee |
DORA — Regulation (EU) 2022/2554 | Article 6(8)(b) — the digital operational resilience strategy establishes “the risk tolerance level for ICT risk, in accordance with the risk appetite of the financial entity” | Setting thresholds from the risk tolerance level |
DORA — Regulation (EU) 2022/2554 | Article 6(8)(c) — the strategy sets out “clear information security objectives, including key performance indicators and key risk metrics” | The KRIs and their thresholds as key risk metrics |
DORA — Regulation (EU) 2022/2554 | Article 5(2)(d) — the management body bears the overall responsibility for setting and approving the digital operational resilience strategy, including the appropriate risk tolerance level of ICT risk | Who decides past tolerance: the management body sets the tolerance |
DORA — Regulation (EU) 2022/2554 | Article 13(3) — lessons from resilience testing and from real ICT-related incidents are incorporated on a continuous basis into the ICT risk assessment process | A breach as a reassessment trigger: lessons from incidents fed into the risk assessment |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 7.2 — taking into account the risk assessment and past significant incidents, determine what is monitored and measured, the methods “to ensure valid results”, when it is measured, who measures, when the results are analysed and evaluated, and who analyses and evaluates them | Inputs and escalation: what is measured, when, and who analyses it |
Definitions
Term | Meaning in this model |
|---|---|
Appetite | The highest residual band of risk accepted without escalation, set by risk category (P05). |
Escalated as red | The red row of the escalation table applied to a KRI whose zone is amber, under the persistence rule (MR-08). The zone is still reported as amber. |
Escalation | Telling the person the escalation table names, within its time, and the review or reassessment that follows. |
Key performance indicator (KPI) | Key performance indicator. A metric that shows whether a control or process is working as intended, judged against a target. |
Key risk indicator (KRI) | Key risk indicator. A metric that gives early warning that a risk in the risk register may be moving, judged against thresholds set from that risk's appetite and tolerance. |
Lagging indicator | An indicator that moves only after harm is done, such as incidents. Useful, but on its own too late to warn. |
Leading indicator | An indicator that moves before harm is done, such as weaknesses past their fix deadline. |
Linked risk | The one risk in the risk register a KRI gives early warning of, named on its card. |
Persistence rule | A KRI amber for [[3]] periods in a row is escalated as red, unless its linked risk has an approved treatment plan that is on schedule (P05 RM-06, RM-07), recorded by the risk owner each period (MR-08). |
Position | Where a risk sits against its category's appetite and tolerance: Within appetite; Outside appetite, within tolerance; Outside tolerance. |
Threshold | A value of a KRI at which its zone changes: green to amber, or amber to red. |
Tolerance | The limit beyond which the people who set it must act, and not just be told. For a risk, the highest residual band tolerated while a plan brings it back (P05). For a KPI, the furthest short of target the audience accepts without a decision (P03). |
Top decider | Who decides at the top, by how the organisation is governed: the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management. |
Treatment plan on schedule | The treatment plan has at least one open action, and every open action is before its due date and not reported at risk by its owner. |
Validated | Accepted by the validator after the completeness, freshness and plausibility checks (MR-05, MR-06). Escalation times count from this date. |
Zone | Where a KRI's value falls: green, amber or red. The zone says what the value suggests about the linked risk. It never changes the risk's position on its own: only a reassessment in the risk register does that (P05). |