Explanation and interpretation

with reference to BS7799 Section 10

Resources available from
WWW.PLAN-IT-CONTROL-IT.COM
(MS Word unless otherwise stated)

When systems are procured or developed in-house security needs to be considered at an early stage and built in. Various controls will be required, many common to all systems and some additional ones will be required following the recommendations from risk assessment.

Risk assessment will help ensure that:

¨ Security is considered prior to implementing new systems;

¨ Business security requirements are defined and implemented;

¨ New applications have appropriate security controls implemented;

¨ Security controls are justified and cost effective;

Risk assessment should also be undertaken prior to changes to organisation (e.g. outsourcing) technology, business process, physical controls to ensure they do not have an adverse impact on IT Security of existing systems.

Title: Business Impact Assessment Checklist

Document: 8-BIAChecklst.doc

Synopsis: Checklist for assessing the business impacts during risk assessment.

Title: Threat and vulnerability questionnaires

Document: 8-ThreatVuln.doc

Synopsis: Checklist of threats and vulnerabilities used during risk assessment.

Title: Risk assessment report template

Document: 8-RiskReport.doc

Synopsis: A detailed and proven presentation 29-page specimen report of a risk assessment including graphical representations of the findings, business impacts, threats and vulnerabilities, and recommendations.

Title: Risk assessment report template

Document: 8-RiskForm.doc

Synopsis: A template form for capturing risks, e.g. policy exceptions.

Title: Risk Register

Document: 8-RiskReg.doc

Synopsis: A 1 page template for recording risks in a register.

Title: Risk Assessment Policy

Document: 8-RiskPol.doc

Synopsis: A 4-page policy giving the background to risk assessment and a recommended approach.