{"id":1732,"date":"2018-12-02T13:42:08","date_gmt":"2018-12-02T13:42:08","guid":{"rendered":"https:\/\/iso27001.solutions\/?p=1732"},"modified":"2019-03-11T18:00:34","modified_gmt":"2019-03-11T18:00:34","slug":"information-security-risk-assessment-and-management","status":"publish","type":"post","link":"https:\/\/ismsalliance.com\/trends\/iso-27001-isms-risk-management\/information-security-risk-assessment-and-management\/","title":{"rendered":"Information Security Risk Assessment and Management"},"content":{"rendered":"

Why Risk Assessment is important ?<\/h2>\n

It is important to ensure that any corporate risk management<\/strong> strategy, risk management method and assessment methods are borne in mind when carrying out information security risk assessments.<\/p>\n

Organisations wishing to achieve certification to ISO\/IEC 27001<\/a> should note that (as per clauses 8.2 and 8.2 of ISO\/IEC 27001) they should carry out information security risk assessments<\/strong>, keep records of those information risk assessments and use the information risk treatment plan derived from the information risk assessments to treat the documented information risks.
\nThe exact risk assessment methodology to be used is not specified by the Standard. Organisations can choose to follow the approach described here, or another approach which suits them better.<\/p>\n<\/div>

<\/div>
<\/div>
<\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/a><\/span><\/div><\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/div>
<\/div>
<\/div>

Information Risk Management<\/h2>\n<\/div>
<\/div>
<\/div><\/div>
<\/div>
\n
\n
\n
\n

Information risk management is the systematic identification and assessment of information risk, coupled with the consideration, planning and application of risk responses, in order to ensure that the exposure to a given risk is at an acceptable level. It is an iterative process which, due to the ever changing internal and external environments and the emergence of new threats and identification of new vulnerabilities, is never complete.<\/p>\n

All organisations have information assets. These information assets are often critical in supporting business operations. Equally, all organisations are exposed to threats and vulnerabilities which constitute risks to those information assets and if left unchecked have the potential to damage the organisation\u2019s ability to meet its stated objectives.<\/p>\n

As such it is prudent to consider the risks which may have a negative impact on their information assets and, through the consistent application of information risk assessments, determine the controls they wish to apply to treat the risks to those assets.<\/p>\n

\n
\n
\n

Only by carrying out information security risk assessments to identify and assess all the risks facing its information assets can an organisation hope to identify how to best utilise its resources to treat those risks. Additionally carrying out and documenting information risk assessments provides for an auditable processdemonstrating and providing justification for decisions made in relation to information security.<\/p>\n

Whilst this toolkit is written from the perspective of risk assessing information assets, it is important to notethis is not the only approach. For those pursuing certification against ISO\/IEC 27001:2013<\/a>, the latest version ofthe standard does not require an information asset-based approach. However, certainly in the short term this is what auditors will be used to seeing, and it will not invalidate an ISMS from their perspective. Regardless\u00a0of the risk assessment methodology chosen, the essential steps of information risk identification followed by assessment of impact and likelihood still apply.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>

<\/div>
<\/div>
<\/div>

Define Information Risk measurement criteria<\/h2>\n<\/div>
<\/div>
<\/div><\/div>
<\/div>
\n
\n
\n

Whilst information security risk assessment is a distinct activity, it is important to ensure that any corporate information risk management strategy, information risk management method and assessment methods are borne in mind when carrying out information security risk assessments. This is in order that the assessment of, and products from, information security risk assessments make sense in the context of the wider organizational risk management framework and fit into wider organizational and strategic risk registers.<\/p>\n

It is also important to note that information risks can be mapped to the type of organisational objective concerned, that is to say strategic (long-term), programme\/project (medium-term) and operational (short- term) objectives. The type of objective which an information risk affects will have some bearing on the level\u00a0of audience who should be reviewing and managing the risk. However there may be interplay between the different levels. For example a project risk could quite easily be relevant in terms of the programme to which it belongs and potentially could affect a strategic objective. As such, risks identified at one level will often feature on the risk register at another.<\/p>\n

Information risk assessments should consider impact in terms of the effect on the organisation\u2019s stated purpose and objectives.<\/p>\n

As a minimum, the following impact areas are considered:<\/p>\n