Information Security Management and Auditing

2.

Information Security Risk Management

2.1.

Risk Management Fundamentals

2.1.1.

Risk Concepts and Terminology

2.1.2.

Risk Management Principles

2.1.3.

Risk Management Lifecycle

2.2.

Risk Assessment Process

2.2.1.

Risk Context Establishment

2.2.1.1.

Organizational Risk Appetite

2.2.1.2.

Risk Criteria Definition

2.2.1.3.

Stakeholder Identification

2.2.2.

Asset Identification and Valuation

2.2.2.1.

Asset Inventory Development

2.2.2.2.

Asset Classification Systems

2.2.2.3.

Asset Valuation Techniques

2.2.3.

Threat Identification and Analysis

2.2.3.1.

Threat Categories

2.2.3.2.

Threat Sources and Actors

2.2.3.3.

Threat Intelligence

2.2.4.

Vulnerability Assessment

2.2.4.1.

Vulnerability Identification Methods

2.2.4.2.

Vulnerability Scanning Tools

2.2.4.3.

Manual Assessment Techniques

2.2.5.

Risk Analysis and Evaluation

2.2.5.1.

Likelihood Assessment

2.2.5.2.

Impact Analysis

2.2.5.3.

Risk Calculation Methods

2.2.5.4.

Risk Rating and Prioritization

2.3.

Risk Assessment Methodologies

2.3.1.

Qualitative Risk Assessment

2.3.1.1.

2.3.1.2.

Scenario Analysis

2.3.1.3.

Expert Judgment

2.3.2.

Quantitative Risk Assessment

2.3.2.1.

Single Loss Expectancy (SLE)

2.3.2.2.

Annual Loss Expectancy (ALE)

2.3.2.3.

Return on Security Investment (ROSI)

2.3.3.

Hybrid Assessment Approaches

2.3.3.1.

Semi-quantitative Methods

2.3.3.2.

Combining Qualitative and Quantitative Techniques

2.4.

Risk Treatment Strategies

2.4.1.

Risk Mitigation

2.4.1.1.

Control Implementation

2.4.1.2.

Control Effectiveness Evaluation

2.4.1.3.

Residual Risk Assessment

2.4.2.

Risk Acceptance

2.4.2.1.

Risk Tolerance Levels

2.4.2.2.

Management Approval Processes

2.4.2.3.

Documentation Requirements

2.4.3.

2.4.3.1.

Activity Elimination

2.4.3.2.

Process Redesign

2.4.4.

2.4.4.1.

Insurance Coverage

2.4.4.2.

Contractual Risk Sharing

2.4.4.3.

Outsourcing Considerations

2.5.

Risk Monitoring and Review

2.5.1.

Continuous Risk Monitoring

2.5.1.1.

Key Risk Indicators (KRIs)

2.5.1.2.

Automated Monitoring Systems

2.5.1.3.

Risk Dashboard Development

2.5.2.

Periodic Risk Reviews

2.5.2.1.

Risk Register Maintenance

2.5.2.2.

Risk Assessment Updates

2.5.2.3.

Reporting and Communication

Previous

1. Introduction to Information Security Management

Go to top

Next

3. Information Security Management Systems (ISMS)