The rapid expansion of digital infrastructures across public and private sectors has intensified the need for governance models capable of addressing cybersecurity risks in a systematic, economically rational, and ethically defensible manner. While numerous frameworks exist for risk analysis, compliance management, and technical security implementation, fragmentation persists between regulatory theory, cost-benefit analysis, and operational cybersecurity design. This article develops a comprehensive risk-based cybersecurity governance framework that synthesizes principles from risk science, regulatory policy, cost-benefit theory, and contemporary cybersecurity standards. Drawing on scholarship in risk regulation (Wiener, 2010), the discipline of cost-benefit analysis (Sen, 2000), foundational risk science (Aven, 2019; Aven & Thekdi, 2022), and cybersecurity frameworks including NIST CSF 2.0 (NIST, 2024), the study constructs a design-science-informed governance architecture. The framework integrates adaptive risk management, human-factor awareness, privacy-by-design principles, and dynamic compliance mechanisms. It incorporates economic rationality through structured cost-benefit integration, including social discounting and judicial scrutiny considerations (Feldstein, 1964; Morrison, 1998), while extending evaluation beyond narrow monetization toward responsibility-centered governance (Boeken, 2024). Methodologically grounded in design science research (Hevner et al., 2004), the study proposes a policy artifact that operationalizes risk-based cybersecurity across cloud, healthcare, and multi-cloud environments. Findings indicate that purely compliance-driven or technically isolated security models are insufficient; instead, adaptive, context-sensitive, and economically informed governance is necessary to manage spillover risks and advanced persistent threats. The discussion highlights theoretical implications for risk science, regulatory accountability, and digital ethics. The article concludes that sustainable cybersecurity governance requires institutional integration of risk analysis, economic evaluation, and technical security design within a coherent normative framework.