Risk Management

Risk Management

1. Risk Control

   • Select Control Strategies
     • When the team chooses a strategy for controlling each risk that results from the vulnerabilities.
   • Implement, Monitor and Assess Control
     • The chosen strategy and it's accompanying controls must be implemented and then monitored on a ongoing basis to determine their effectiveness.
   • Justify Control
     • Exploring all consequences of the vulnerability to the information assets. The organisation must determine the actual and perceived advantages of the control as opposed to it's actual disadvantage.

2. Risk Assessment

   • Evaluate Loss Magnitude
     • The likelihood of an attack combined with it's expected probability of success of it's target your organisation.
   • Calculate Risk
     • The purpose of relative and simplistic risk determination.
   • Assess Risk Acceptable
     • Rankings of risk levels with their vulnerability. The ranking provide a simplistic approach to documentation residual risk.

3. Risk Identification

   • Identify, Inventory and Categorize Assets
     • Categorising assets, in involving more as you go into detail into the analysis. The purpose of this process is to find the correlative priority of assets to the success of the organisation.
   • Classify, value and Prioritize Assets
     • Putting the assets as a priority.
   • Identify and Prioritize Threats
     • Realistic threats should be investigated further, while the unimportant threats are put aside.
   • Specify Asset Vulnerabilities
     • Reviewing each information assets for each relevant threat and create a list of vulnerabilities.