Information Security Management Series: Risk Assessment
by Sarah Harvey / July 11th, 2014
Are you wondering why a risk assessment is so important? Do you need more information about how to conduct a risk assessment? If it is your first time conducting a risk assessment, or if you are looking for a way to simplify your risk assessment process, follow these nine steps:
- Asset Characterization: Identify your organization’s assets such as hardware, software, human resources, data, and processes.
- Threat Identification: Detect either man-made or natural events that could take advantage of an asset’s flaws.
- Vulnerability Identification: Locate both known and unknown flaws or weaknesses in assets that could result in the loss of integrity, availability, or confidentiality.
- Control Analysis: Determine the current controls that have been used to mitigate potential threats or vulnerabilities and implement future controls.
- Likelihood Determination: Analyze the likelihood of a specific event having a negative effect on an asset.
- Impact Analysis: Identify what the impact would be on business if an event has a negative effect on an asset.
- Risk Determination: Use the current analysis to determine whether the asset is material or non-material.
- Control Recommendation: Document the status of the protection of the asset.
- Results Documentation: Document the constraints on the remediation such as time, budget, and/or resources.
For more information about how you can complete a risk assessment or how KirkpatrickPrice can help you meet your risk assessment needs, contact us today.
