Lesson 2 Risk Management Issues

Objective 3 At the end of Lesson 2, you will understand and be able to discuss some of the issues surrounding the use of risk management by organizations.

Issue Number One Risk Management allows us to perform the organization’s mission with a reduced impact of harmful acts caused by others or nature.

Risk Analysis is Required OMB Circular A-130 Requires risk-based approach to determine adequate security Include major factors in risk management: value of the system to mission threats vulnerabilities effectiveness of current or proposed safeguards OMB Cir A-130, Appendix III, Security of Federal Automated Information Systems

As Never Before -We Operate in A Changing Environment political social economic technical

Risk Management Takes Time and Money -- and should be worth every second and penny

More Effective and Efficient than Risk Avoidance Risk Management

Risk management needs data Data needs analysis Analysis needs synthesis Need for analysis and synthesis of large volume of complex data Risk Assessment Data Risk Assessment 1. 2. 3. 4.

Enlightenment Through Risk Management Better understanding of organization Acceptance of decisions by workforce Heightened security awareness Other benefits

Better Understanding of the Organization Mission Threats Vulnerabilities Security Countermeasures

Better Acceptance of Decisions Countermeasures

Heightened Awareness of Security

Other Risk Management Benefits consistency of assessment process customer involvement customer satisfaction improved security services that are: really needed really work really reduce risk

Summary Risk Management Issues Issues affect how the risk management process is conducted and how effective it is There are many issues Many issues are not not obvious