How to Complete a Risk Assessment in 5 Days or Less

Size: px

Start display at page:

Download "How to Complete a Risk Assessment in 5 Days or Less"

Sophia Payne
6 years ago
Views:

1 How to Complete a Risk Assessment in 5 Days or Less THOMAS R. PELTIER ( rj j!c) CRC Press \f^ J Taylor & Francis Group Boca Raton London New York CRC Press is an imprint of the Taylor & Francis Croup, an Informa business AN AUERBACH BOOK

2 Contents Acknowledgments About the Author Introduction xi xiii xv 1 The Facilitated Risk Analysis and Assessment Process (FRAAP) Introduction FRAAP Overview FRAAP History Introducing the FRAAP Key Concepts The Pre-FRAAP Meeting Pre-FRAAP Meeting Checklist Pre-FRAAP Meeting Summary The FRAAP Session Overview FRAAP Session Introduction FRAAP Session Talking Points FRAAP Threats Identification Identifying Threats Using a Checklist Identifying Existing Controls Establishing Risk Levels Residual Risk Using a Threats Identification Checklist FRAAP Session Summary Post-FRAAP Process Complete the Action Plan Conclusion 54 2 Risk Analysis (Project Impact Analysis) Overview 57 VII

3 viii Contents 2.2 The Difference between Risk Analysis and Risk Assessment Risk Analysis and Due Diligence Risk Assessment and Fiduciary Duty Performing a Risk Analysis Risk Analysis Elements Other Considerations When to Conduct a Risk Analysis Final Words Sample Risk Analysis Questionnaire Sample Risk Analysis Report Outline 65 Pre-Screening Introduction Background Pre-Screening Example Pre-Screening Example Pre-Screening Example Pre-Screening Example Summary 78 Business Impact Analysis Overview BIA versus Risk Assessment Creating a BIA Process Creating the Financial Impact Table Working the BIA Process Additional Examples, Objectives of the BIA ' Using Questionnaires for a BIA Data Collection and Analysis Prepare Management Presentation Final Thoughts 97 Gap Analysis Introduction : Background GAP Analysis Process Gap Analysis Example Gap Analysis Example How to Use the Self-Assessment Checklist Summary 108

4 Contents ix Appendix A Facilitator Skills Ill Appendix B FRAAP Team Members 117 Introduction : 117 The Risk Assessment Team 118 Conclusion 123 Appendix C Project Scope Statement 125 Overview 125 Summary 128 Appendix D Laws, Standards, and Regulations 129 Appendix E Frequently Asked Questions about Risk Management 131 Introduction 131 Is There a Difference between Risk Analysis and Risk Assessment? 131 Why Should a Risk Analysis Be Conducted? 132 When Should a Risk Assessment Be Conducted? 132 Who Should Conduct the Risk Assessment? 133 How Long Should a Risk Assessment Take? 134 What Can a Risk Analysis or Risk Assessment Analyze? 134 Who Should Review the Results of a Risk Analysis and Risk Assessment? 134 How Is the Success of the Risk Analysis Measured? 135 Summary ; 135 Appendix F Risk Analysis Versus Risk Assessment 137 Overview 137 The Difference between Risk Analysis and Risk Assessment 137 Risk Analysis and Due Diligence '. 138 Risk Assessment and Fiduciary Duty 138 Conducting a Risk Assessment 139 Risk Assessment Timetable 140 Risk Assessment and Risk Analysis Results 140 Risk Management Metrics 140 Summary 141 Appendix G Sample Threat Checklist 143 Appendix H Sample BIA Questionnaire 153

5 Contents Appendix I Sample Risk Assessment Management Summary Report 251 Risk Assessment Scope Summary 252 Assessment Methodology Used 252 Assessment Findings and Action Plan 253 Full Findings Documentation 254 Conclusion 254 Appendix J Project Scope Statement 259 Introduction 259 Project Statement 260 Specifications 260 Well-Defined Standards and Metrics 262 Summary 263 Appendix K Why Risk Assessments Fail 265 Scope Creep 265 Ineffective Project Team 266 Stating Concerns as How They Impact Security 266 Every Threat Is a Major Concern 267 Conclusion 267 Appendix L Gap Analysis Examples 269 Overview 269 Gap Analysis Using ISO Answer the Following Questions 270 Gap Analysis Using Utility-Specific Standards 298 Gap Analysis Sample 3 Using Combination of Standards and Laws 344 Appendix M Control Lists 399 Overview 399 Appendix N Heat Charts 423 Index : 431

Risk Parity. Fundamentals. Edward E. Qian. PMD CFA

Risk Parity. Fundamentals. Edward E. Qian. PMD CFA Risk Parity Fundamentals Edward E. Qian. PMD CFA CRC Press Taylor & Francis Group Boca Raton London New York CRC Press is an imprint of the Taylor & Francis Croup, an informa business A CHAPMAN & HALL