A process for the management of risk in the life cycle is defined. It can be added to the existing set of software life cycle processes defined by the ISO/IEC 12207 or ISO/IEC 15288 series of standards, or it can be used independently.

This project is being performed jointly with ISO/IEC JTC 1/SC 7. As a result of balloting in ISO, the statement of scope was modified as follows: "This standard describes a process for the management of risk during systems or software acquisition, supply, development, operations, and maintenance."

As a result of balloting in ISO, the statement of purpose was modified as follows: "The purpose of this standard is to provide suppliers, acquirers, developers, and managers with a single set of process requirements suitable for the management of a broad variety of risks. This standard does not provide detailed risk management techniques, but instead focuses on defining a process for risk management in which any of several techniques may be applied."