Risk Framework Examples for Executives and Families

A risk framework is the structure an organization uses to identify, assess, treat and monitor risk over time. The best-known examples are NIST RMF, NIST CSF 2.0, ISO 31000, COSO ERM and OCTAVE. Each was built for a different job, and none was written for a principal’s daily life. The skill is borrowing their logic and applying it to your people, homes, travel and digital footprint. This guide walks through the main examples, then shows how we adapt them for executives, family offices and the assistants who run their calendars.

TL;DR

• A framework runs the whole program (governance, roles, review). A methodology is the narrower scoring method inside it.
• Core examples: NIST RMF (seven steps), ISO 31000 (principles, framework, process), COSO ERM (five components), OCTAVE (three phases), NIST CSF 2.0 (cyber outcomes).
• For executives and families, the same logic works across four areas: person, residence, travel and digital life.
• Every accepted risk needs a written rationale, a named owner and a review date.
• Subscription access to a security partner keeps the framework alive between incidents instead of leaving it as a document.

Table of Contents

• Framework vs. methodology: what is the difference?
• Risk framework examples at a glance
• NIST Risk Management Framework: seven steps
• ISO 31000: principles, framework, process
• COSO ERM: governance for boards
• OCTAVE: assets first
• Applying a framework to executive and family risk
• What is an example of acceptable risk?
• Choosing and adapting a framework
• Risk-based testing in a broader framework
• Our perspective
• How AMERINE turns a framework into coverage
• FAQ
• Sources

Framework vs. methodology: what is the difference?

A framework answers “how do we run risk management consistently?” A methodology answers “how do we assess this particular risk?” One practitioner summary puts it this way: without the methodology, risk decisions become subjective, and without the framework, scores exist but never turn into action, accountability or oversight.

ISO 31000 draws the same line inside one standard. One analysis of the standard describes the framework as designed once and then reviewed, while the process runs every time something new is assessed. Most mature programs use all three layers: a framework to organize the work, a methodology to score risks, and any standards that customers or regulators expect.

For a family office, this matters in practice. A threat score for one public appearance is a methodology output. The standing rule that says who reviews that score, who can accept the residual risk and how often it is revisited is the framework.

Risk framework examples at a glance

These are the frameworks readers meet most often, with the risk each one was designed to address, according to a comparison of ten options.

No single row is the right answer for a principal. The useful move is to pick the one whose structure fits your decision-making and borrow from the others.

NIST Risk Management Framework: seven steps

The NIST RMF is a flexible, repeatable, measurable process for managing security and privacy risk, and it applies to any type of system and any size of organization. Its seven steps are Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor.

The lesson for personal risk is the order. Preparation comes first: define what you are protecting, who decides, and what counts as an acceptable outcome. Only then do you choose controls. Many people do the reverse and buy cameras before deciding what the cameras are for.

NIST also publishes CSF 2.0, which positions cybersecurity as part of a holistic enterprise risk approach, including reputational damage and lost revenue as consequences. That framing suits an executive whose personal accounts and corporate reputation are tied together.

ISO 31000: principles, framework, process

ISO 31000:2018 gives principles and guidelines for identifying, analyzing, evaluating, treating, monitoring and communicating risk. It is not a certifiable standard and can be used by any organization regardless of size or sector, and it was reviewed and confirmed in 2023.

The process runs through communication and consultation, scope and criteria, risk assessment (identification, analysis, evaluation), treatment, monitoring and review, and recording and reporting, as laid out in the Brazilian edition of the standard. The standard is methodology-agnostic, so qualitative or quantitative scoring both fit.

That flexibility is why ISO 31000 is a good backbone for a private client. You can score a motorcade-free commute with simple high, medium and low ratings and still sit inside a recognized structure.

COSO ERM: governance for boards

COSO’s Enterprise Risk Management framework dates to 2004 and was updated in 2017, with supplementary guidance and a compendium of real-world examples. The 2017 version has five components and 20 principles: Governance and Culture, Strategy and Objective-Setting, Performance, Review and Revision, and Information, Communication and Reporting.

COSO and ISO 31000 are complementary. ISO supplies the process, while COSO supplies board oversight, culture and reporting. If you sit on a board with a duty-of-care obligation toward executives, COSO’s governance language is the one your directors already speak. Our corporate security program framework guide shows how that language translates into executive protection responsibilities.

OCTAVE: assets first

OCTAVE was published by Carnegie Mellon’s Software Engineering Institute in 1999 and identifies critical information assets, the threats to them and the vulnerabilities that could be exploited. It runs in three phases: organizational evaluation, technological evaluation, then strategy and plan development, across eight processes.

Its asset-first logic transfers well. For a family, the assets are people, the residence, reputation, financial accounts, devices and routines. Start there, then look at who might target each one and how.

Applying a framework to executive and family risk

Here is how the shared logic of these frameworks maps onto four areas. The scenario below is illustrative, not a real case.

Step 1: Define the asset and the context

A chief executive travels abroad for a multi-country board cycle. Assets include the executive, two family members at home, the devices that carry corporate email, and the executive’s public schedule. Context includes recent media attention and the executive’s public profile.

Step 2: Identify threats and exposures

• Person: unwanted approaches at public events, predictable movement patterns.
• Residence: visibility from the street, staff access, delivery routines.
• Travel: unfamiliar ground transport, hotel exposure, border and connectivity risks.
• Digital: account takeover, phishing aimed at assistants, doxxing that exposes a home address, and compromised devices on hotel networks.

Digital exposure is where physical and cyber risk meet. A leaked home address becomes a residential security problem, and a hijacked calendar becomes a travel security problem. Our guides on cybersecurity for high-net-worth individuals and on why executive targeting has risen go deeper on how attackers pick targets.

Step 3: Evaluate against criteria

Set your scale before you score. A simple five-point likelihood and five-point impact scale is enough. What matters is that the same scale is used across the house, the road and the inbox, so a phishing risk and a transportation risk can be ranked side by side.

Step 4: Treat the risk

Treatments include protective transportation, advance planning, a hardened home perimeter, travel device hygiene (clean devices, controlled connectivity, no reuse of passwords across accounts), removal of personal data from public listings, and phishing awareness for the assistants and household staff who handle the principal’s accounts.

Step 5: Monitor and review

Risk is not static. One analysis warns that a residual score not tied to control evidence will not update when a control lapses, so decisions rest on a snapshot of the past. Build triggers into the framework: a new public role, a move, a change of household staff or a spike in online hostility should each prompt a reassessment.

A security assessment is the usual starting point because it produces the scored baseline everything else depends on.

What is an example of acceptable risk?

A low-likelihood, low-impact risk may be accepted when it falls within an established threshold. For a family, that might be a low-profile local errand with no public schedule exposure.

Formal acceptance needs four things, according to one risk treatment guide: a written rationale, confirmation that residual risk is within appetite, a named owner who monitors it, and a scheduled review date. Reviews are typically quarterly for medium risks and monthly for high ones.

Who signs also matters. One acceptance guide assigns low risks to frontline supervisors, medium risks to department managers and high risks to senior leadership or an executive risk committee. In a family office, translate that to the household manager, the chief of staff and the principal or family council. Risks accepted today may not stay acceptable in six months, so the record should be revisited when the environment shifts.

Choosing and adapting a framework

Heads of enterprise risk typically select an existing framework such as COSO or ISO 31000, then customize it. A custom framework should still establish a governance model, define risk for your situation, set an overall strategy and name the assessment and mitigation techniques.

A practical selection guide:

1. Corporate board or executive team: start with COSO ERM for governance, use ISO 31000 for the process.
2. Family office: use ISO 31000 as the backbone and add an asset-first lens from OCTAVE.
3. Digital-heavy exposure: layer NIST CSF 2.0 outcomes over the personal and corporate accounts.
4. Event organizers: use the ISO process for each event, with scope and criteria reset every time. See our corporate event security planning guide.

If you are writing the written rules that sit under the framework, our guide to creating a corporate security policy covers that layer, and our note on family office security beyond the residence covers the wider scope.

Risk-based testing in a broader framework

Risk-based testing means directing testing effort toward the areas where failure would hurt most, rather than testing everything equally. In a security program, the same idea applies: drills, phishing simulations and device checks should target the exposures your assessment ranked highest. The framework tells you what ranks highest, and the testing confirms the controls hold.

Our perspective

Most security failures we see are not failures of equipment. They are failures of continuity. A plan is written, filed and forgotten, while the principal’s life keeps changing.

We start with an assessment because coverage without a baseline is guesswork. We confirm scope in writing so everyone, from the executive assistant to household staff to legal counsel, knows what is covered and who is responsible. Our team’s Secret Service experience shapes how we think about advance work, low visibility and the discipline of reviewing a plan after every change.

We also treat digital and physical risk as one problem. Account takeover, doxxing and phishing lead to physical exposure, and a travel itinerary is both a logistics document and a target. A framework that ignores either half leaves a gap.

That is why we built subscription membership around priority access. A framework only works if someone is there to run it when circumstances change, and a standing relationship means the assessment, the review cycle and the response all sit with a team that already knows your situation. Availability terms are set out in writing, and we coordinate worldwide through vetted licensed local providers.

AMERINE Team

How AMERINE turns a framework into coverage

AMERINE Executive Logistics is based in the Dallas–Fort Worth area and licensed in Texas. We serve clients worldwide, domestic and international, inbound and outbound, from single trips to multi-country movements and large events. We work anywhere in the world through vetted licensed local providers, not local offices or in-country staff.

Our approach follows the logic above: assessment first, written scope, then protection across person, residence, travel and digital life. Our Access, Preparedness and Continuity memberships give subscribers priority access and a standing review rhythm, so the framework stays current.

For related services, see our executive cybersecurity work, travel and event security and residential security.

FAQ

What is a risk methodology in cybersecurity?

It is the defined method for identifying, analyzing and prioritizing cyber risks, including how likelihood and impact are measured. It can be qualitative or quantitative, such as FAIR for financial quantification. It sits inside a broader framework that handles governance and review.

What are the main risk categories for an executive or family office?

A practical split is personal safety, residential, travel, digital and reputational risk. Each can be scored on the same scale so they can be compared. Reassess when something changes, such as a new public role or a move.

Is ISO 31000 certifiable?

No. ISO describes it as guidance usable by any organization, not a certifiable standard. If you need a certifiable system for information security, ISO/IEC 27001 is the related option.

How often should accepted risks be reviewed?

Guidance commonly suggests quarterly for medium risks and monthly for high risks, or sooner when a trigger occurs. For a principal, travel, a new public profile or a change in household staff are sensible triggers.

Sources

• NIST RMF Small Enterprise Quick Start Guide
• NIST Cybersecurity Framework 2.0: Enterprise Risk Management
• ISO 31000:2018 Risk management guidelines
• ISO 31000 process (ABNT NBR edition)
• COSO Enterprise Risk Management guidance
• COSO ERM framework components and principles
• Risk management frameworks compared
• Risk methodology vs. risk framework
• Risk assessment framework components
• Risk scoring methodology
• Top risk management frameworks (OCTAVE)
• OCTAVE phases comparison
• Risk treatment options
• Risk acceptance guide
• Why ISO 31000 is the reference point
• What to include in ERM frameworks

If you want a framework that someone actually runs for you, request a conversation about an AMERINE subscription through the AMERINE website.

Recommended

• When Does a CEO Need Executive Protection? 12
• Family Office Security Beyond Residential
• Executive Travel Risk Briefs
• Geopolitical Risk Briefs for Executives