Strategy, Governance and Training
Information Security Risk Management
We assess your information security risks with assets, threats and business impact. We keep your risk register up to date with test findings.
What it is
Information security risk management assesses which asset could be affected by which threat, to what extent, and the business cost. ISO/IEC 27001 sets requirements for assessing and treating information security risks. ISO/IEC 27005 guides how to conduct this process. Control selection and the Statement of Applicability result from this assessment.
Scope
- Defining the risk assessment method and acceptance criteria
- Identifying critical processes and information assets with their owners
- Linking threats and vulnerabilities to test findings
- Risk register, risk treatment plan and Statement of Applicability
- Decision record for management acceptance of residual risks
The need
When organizations need it
- When preparing for your first ISO/IEC 27001 certification.
- When you need to explain to management which accumulated penetration test findings are real business risks.
- Before a new system, supplier or business process goes live.
Method
How we work
-
Method
We define the risk criteria and acceptance level with management.
-
Assets
We identify critical processes and supporting systems with their owners.
-
Assessment
We assess likelihood based on test findings and impact based on business loss.
-
Treatment
For each risk, we record the decision to reduce, share, avoid or accept it with its owner.
Outcome
What you have at the end
You have an up-to-date risk register with named owners, based on test findings. Residual risks are accepted by management decision.
Frequently asked questions
Is the risk assessment qualitative or quantitative?
We select the method to fit your needs. Qualitative scales offer a quick start. Monetary impact estimates can be added for critical scenarios.
When is the risk register updated?
It is updated at planned intervals and after significant changes. New test findings and incidents are also recorded.
Why are test findings included in the risk register?
Findings move likelihood from assumption to evidence. A demonstrated attack path directly changes the assessment of the related risk.
Strategy, Governance and Training
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting