Risk Management Process

Risk Management Process

1. Identify, classify and prioritize organizations assets

   • Identify vulnerabilities that may place assets at risk
     • Identify threats that may cause assets information to be compromised
       • Identify controls that will help protect identified assets
         • Combine Information gathered about assets, vulnerabilities and controls, and define risks
           • Evaluate relative risks for each vulnerabilities by rating them
             • Create list of potential controls for each threat and its associated vulnerabilities that have a residual risk
               • Document results of assessment
                 • Choose one of the five basic strategies to control each of the risks (defend, transfer, mitigrate, accept, terminate