The risk assessment of information and network systems is a mandatory Appendix C document and requires board/management approval under ID.RA-05 point 3. This document should demonstrate how the organization identifies cyber risk scenarios, evaluates impact/likelihood, and justifies risk-based control choices.
Key takeaways
- Risk assessment is not optional support material; it is an approval-required baseline document.
- ACN guidance repeatedly links implementation clauses to outcomes of ID.RA-05.
- A defensible assessment must connect methodology, scope, assumptions, and control decisions.
- A reusable template/workbook reduces inconsistency across business units and suppliers.
What an approvable ID.RA-05 assessment must show
| Objective | Minimum output | Evidence |
|---|---|---|
| Scope clarity | In-scope systems/services and dependencies | Scope register and inventory reference |
| Risk model transparency | Defined criteria for likelihood/impact | Methodology section and scoring rules |
| Scenario coverage | Relevant threat and failure scenarios | Risk register entries |
| Decision traceability | Link from risks to control priorities | Risk-to-control mapping and approvals |
Practical template structure
1. Purpose, legal basis, and scope
State ID.RA-05 reference, covered entities/services, and assessment boundaries.
2. Methodology and scoring model
Define scales, risk thresholds, and assumptions used for consistent assessment.
3. Asset and dependency context
Map critical systems, data flows, suppliers, and supporting infrastructure.
4. Scenario analysis and inherent risk
Evaluate realistic cyber scenarios before current controls.
5. Current controls and residual risk
Assess control effectiveness and identify residual exposure.
6. Prioritization outputs
Classify top risks and define treatment priorities for planning.
7. Approval and review cycle
Include formal approval block and periodic reassessment cadence.
Risk-based clause handling: what teams often miss
- Risk-based clauses require explicit rationale, not generic statements.
- Scope reductions must be documented with objective criteria.
- Supplier and third-party risks should be integrated, not isolated.
- Residual-risk acceptance must identify accountable approvers.
- Assessment results must feed treatment and improvement plans.
20-day risk-assessment hardening checklist
- Confirm critical system/service inventory and ownership.
- Standardize risk scoring model across functions.
- Rebuild top-risk scenarios with clear assumptions and evidence.
- Link each high risk to planned controls and owners.
- Document accepted residual risks with approval trace.
- Submit finalized assessment for governing-body approval.
FAQ
Is the ID.RA-05 assessment a board-approval document?
Yes. Appendix C explicitly lists the risk assessment document with reference ID.RA-05 point 3.
Can we use only qualitative risk ratings?
You can, if methodology is consistent and decision criteria are explicit. In practice, mixed models (qualitative + quantitative indicators) often improve traceability.
How often should this document be updated?
At minimum on defined review cadence, and earlier when threat exposure, architecture, or business context changes materially.
Conclusion and next steps
A strong ID.RA-05 document is the decision engine for the rest of the NIS documentation stack. Prioritize methodological consistency, risk-to-control traceability, and formal approval readiness so downstream plans are defensible and executable.
Related reading
- NIS2 mandatory documents master guide: what must be approved by the board and what to prepare now
- NIS2 risk treatment plan: practical guide for ID.RA-06 approval
- NIS2 Identification Controls (ID): Inventories, Risk Assessment, and Improvement Cycle
- Aegister NIS2 Compliance Service
- Cyber Check-up
