With the explosive rise of digital information, the continued success of modern enterprises has become inextricably bound to the effective use and management of data. However new efficiency-driving technologies, global interconnectivity, and remote work have also introduced several significant and high-profile information risks.
The specter of risk is leaving organizations with no choice but to improve the overall management of various cyber risks. What follows is a step-by-step process (based on the Information Security Forum’s IRAM2 methodology) that cybersecurity and risk practitioners can leverage to assess and manage information risk.
Step 1: Scoping exercises
The objective of a scoping exercise is to provide a business-centric view of an identified risk. This involves achieving alignment and agreement between stakeholders on the business scope (intellectual property, brand or reputation, organizational performance) and the technological scope of the assessment (information architecture, user profiling, assessment of a technology or a service).
This exercise can help determine which party will be responsible for assessing the various risk…
