Information security risk management: from assets to management decisions

1Introduction

Risk management systematically identifies, analyses, evaluates and treats information risks; it is CISSP’s first domain and the core of ISO 27001.

2Discussion

Start with assets, then threats and vulnerabilities.

Estimate likelihood and impact, qualitatively or quantitatively, to prioritise.

Treat by mitigating, transferring, avoiding or accepting; business owners decide on residual risk.

3Conclusion

Repeat periodically and report to leadership.