A multinational's risk team must select a risk management framework that is an international, principles-based standard applicable to any type of organization and any type of risk, rather than one designed for federal information systems or limited to cloud computing. Which should it choose?

ISO 31000 provides principles, a framework and a process for managing risk that can be applied by any organization, regardless of size, sector or type of risk. It is an international standard focused on integrating risk management into governance and decision-making, and it describes the process of establishing context, risk assessment, risk treatment, monitoring and review and communication. That fits a multinational wanting a broad, principles-based foundation. The NIST Risk Management Framework in SP 800-37 is a structured process for categorizing, selecting, implementing, assessing, authorizing and monitoring controls for information systems, developed for US federal agencies, although others adopt it voluntarily; it is neither an international standard nor scoped to every risk type. The ENISA Cloud Computing Risk Assessment is a respected analysis of the risks and benefits of cloud adoption, but it is limited to cloud computing rather than enterprise risk generally. ISO/IEC 27017 is a code of practice for information security controls for cloud services; it is a control set, not a risk management framework. Exam caveat: organizations frequently combine frameworks, using ISO 31000 for enterprise risk and NIST or ISO/IEC 27005 for information security risk. Operational check: confirm the selected framework is documented in the risk policy with defined criteria, roles and review cycles.