Glossary term
Information Security Risk Assessment
Subject: Technology, Cyber and Data, Information Security Frameworks
Also known as: Cyber risk assessment, IT security risk assessment
An information security risk assessment is a structured exercise that identifies what information assets matter, what threats and weaknesses could harm them, and how likely and costly the harm would be.
Explanation
The work usually follows a set order. First the team lists the assets that matter, such as customer databases, payment systems and source code, and decides how valuable each one is. Next it identifies threats (ransomware, insider misuse, supplier failure) and the weaknesses those threats could use. Likelihood and impact are then scored, qualitatively on a scale or in money terms, and the results are ranked. For each high risk the owner chooses to reduce, transfer, accept or avoid it, and the choice goes into a risk treatment plan. The exercise is repeated when systems, suppliers or threats change. It feeds the wider enterprise risk register and is a core requirement of ISO/IEC 27001. Budget for firewalls or training can then be tied to a named risk on the register, which is the first link a reviewer asks to see.
Example
A hospital group assesses its patient records system. The team finds the system holds the most sensitive data, runs on ageing software and is reachable by a third-party billing vendor. Unpatched software and vendor access rank highest. The group funds an upgrade and tighter vendor access before spending on lower-ranked items.
Not to be confused with
- Vulnerability scan
- A scan lists technical weaknesses. A risk assessment also weighs threats, asset value and impact to decide which weaknesses matter most.