### Surveys on IS Risk Management Frameworks  
In today's digital age, the close connection between information systems and organizational processes calls for a comprehensive risk management framework. By integrating these two elements, businesses can effectively mitigate risks and safeguard their operations. It is essential to have a well-defined framework in place to ensure the smooth functioning of both information systems and organizational processes while minimizing potential threats. There are numerous frameworks available in the market, each with its own unique features. However, two of the most widely adopted frameworks used by organizations are those developed by NIST and ISO. The National Institute of Standards and Technology has made significant contributions to the establishment of IT security standards. Two notable standards are NIST SP 800-39 and NIST SP 800-30 (Revision 1). NIST SP 800-39 offers a thorough framework for managing information security risks [27]. The primary objective of the standard is to effectively manage risk at the organizational level. It provides a consistent approach that fosters better governance and enables a deeper comprehension of how IT security influences organizational operations [28]. The standard known as SP 800-39 outlines risk management using four key components: risk framing, risk assessment, risk response strategy, and risk monitoring [29]. The goal of risk framing is to establish an actionable strategy for effectively managing IT security risks. This particular step takes into account the element of risk within the established environment, which acts as the framework for making decisions based on risk factors [30]. Risk framing entails the identification of risks based on various factors such as assumptions, constraints, tolerance levels, priorities, and trade-offs. Specifically, risk tolerance refers to the level of risk that is considered acceptable [27]. Risk framing refers to the process of developing a risk management strategy encompassing risk assessment, risk monitoring, and response strategies. During the risk assessment phase, potential threats, vulnerabilities, possible damages, and likelihood of exploits are identified. The SP 800-30 (Revision 1) standard is the NIST framework that corresponds to IT security risk assessment. In addition, a risk management strategy includes risk monitoring, which is responsible for ensuring consistent compliance verification and assessing the effectiveness of ongoing risk responses [31]. The risk assessment component is a crucial element of risk management as it accurately evaluates the likelihood and potential impact of an IT security risk [32]. The mentioned standard encompasses guidance on the necessary steps to effectively prepare for and carry out a risk assessment. It also includes information on how to monitor and evaluate the assessment processes. It is worth noting that risk assessment is closely connected to the three tiers of risk management as outlined in the SP 800-39 standard [30]. The International Organization for Standardization (ISO) and the International Electro Technical Commission (IEC) have put forth standards to address IT security, known as the ISO/IEC 27000 series. Of particular importance is the ISO/IEC 27005 standard, which provides guidance on information risk security. A proposed approach suggests a continuous process of activity sequences that encompasses several essential steps. These steps involve establishing context, assessing information, treating and monitoring risks, and informing the stakeholders of the organization [29]. The ISO/IEC 27005 standard offers broad guidelines for IT risk management, making it relevant and applicable to a range of organizations, such as small and medium enterprises, nonprofit organizations, and government agencies [33]. One notable distinction between it and the NIST standard lies in its structural framework, specifically in the absence of any prescribed approach for risk management.