[go: up one dir, main page]
Scribd
Upload
60 views9 pages

Risk Management Approach Draft

The document outlines Sumeru Information Security Consultants' risk management approach. It involves 5 phases: [1] understanding organizational risk culture and appetite, [2] identifying risks through assessment of assets and services, [3] analyzing risks through evaluation of likelihood and impact, [4] treating risks by reducing, transferring, terminating or tolerating them, and [5] continuously communicating, monitoring and reviewing the risk management process. The approach aims to help clients establish a comprehensive risk management program.

Uploaded by

salman
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
60 views9 pages

Risk Management Approach Draft

The document outlines Sumeru Information Security Consultants' risk management approach. It involves 5 phases: [1] understanding organizational risk culture and appetite, [2] identifying risks through assessment of assets and services, [3] analyzing risks through evaluation of likelihood and impact, [4] treating risks by reducing, transferring, terminating or tolerating them, and [5] continuously communicating, monitoring and reviewing the risk management process. The approach aims to help clients establish a comprehensive risk management program.

Uploaded by

salman
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 9

Risk Management

Approach
Sumeru Information Security Consultants
INNOVATION | COMMITMENT | EXCELLENCE
Understanding the Scope

1 Begin with a Risk Culture awareness

2 Form an understanding on the current Risk Appetite

3 Discuss existing Risk tolerance with the Stakeholders

Form an understanding of the business, strategy, operations & technical context in par

4 with people, processes and technology


Risk Management Process
Overall Approach
Risk Assessment

Risk
Identification
Risk analysis
• Risk Register
Risk Evaluation • Risk Treatment
Based on CIA status
criticality value
Based on Risk Treatment
probability or
likelihood of the Risk
threat to occur
Communication
Based on the
impact of the Monitor &
consequences Review
Treat, Terminate,
Tolerate & Transfer
• An iterative
process
• Risk Owners
Risk Identification Approach

Process Services • Utilize the context


• Utilize the context
information information gathered
• Identify the from the organization
confidentiality • Assess the risk based
requirement on public/private
• Identify the integrity access
requirement • Assess the risk to
• Identify the availability confirm the
requirement completeness of info
• Classify the risk based • Uptime/Downtime of
on low, medium or the service at all times
high • Identify the risks
• Calculate the risk relevant to the service
criticality value • Derive the risk
criticality value
Risk Analysis Approach
Likelihood

Threat • Likelihood of the Vulnerability • Vulnerabilities are


threat occurring weaknesses
• natural threats associated with an
• unintentional threats organization’s
(an employee assets/services
mistakenly accessing • Understanding
the wrong your vulnerabilities is
information) the first step to
• intentional threats managing your risk
(spyware, malware, • E.g. what kind of
adware) network security
Risk Evaluation Approach

Impact • the measure of Consequence


• a consequence
business impact that value based on the
could be caused to the
level of impact from
organization if the
identified risks were to highly catastrophic,
materialize moderate or minor
affect

Risk value = Risk criticality value * likelihood * consequence


Risk Treatment Approach

Transfer Terminate (Avoid) Tolerate


Treat
• Insuring: Insure • Discontinuing the • If the level of risk
service will not affect meets the risk
• Risk Reduction the associated
the business acceptance criteria,
• Risk Deduction Asset / Service • Identified risk is too there is no need for
• Control • Outsourcing: complicated to be implementing
Enhancement qualified third mitigated additional controls
• Control party service • Cost of Risk and the risk can be
Implementation provider treatment exceed accepted.
the benefits
Risk Communication | Monitor & Review

Risk
Identification Risk Register

Risk Risk Risk


Risk Treatment Plan Risk Prioritization Review
Communication Risk Analysis Communication Communication

Risk Treatment Status


Risk Evaluation

Phase 1 Phase 2 Phase 3 Phase 4 Phase 5

Risk Corrective Risk Review with


Current State Risk Preparation of Risk Meeting with Risk
Culture Treatment Plan Actions for risk Acceptance Management on
Register Assessment Report Owners
Discussion mitigation criteria Risk register
Thank You!

You might also like