Phases of Risk Management
The prime objective of a risk management process is to achieve the optimum balance between maximizing business opportunities and minimizing vulnerabilities and threats. To achieve this objective, the information security manager should have a thorough understanding of the nature and extent of a risk applicable to the organization. A mature organization will have a dedicated enterprise risk management (ERM) group to monitor and control risk.
The first step in the development of a risk management program is to establish the context and purpose of the program. Management support can be gained only if the program has appropriate context and purpose.
Risk management must operate at both the strategic as well as the operational level. The effectiveness of a risk management program depends on how well it is integrated into an organization's culture and the extent to which it becomes everyone's responsibility.
Phases of Risk Management
A risk...