Risk management overview
The prime objective of a risk management process is to achieve an optimum balance between maximizing business opportunities and minimizing vulnerabilities and threats. To achieve this objective, the information security manager should have a thorough understanding of the nature and extent of the risks that an organization may encounter. A mature organization has a dedicated enterprise risk management (ERM) group to monitor and control such risks.
The first step in developing a risk management program is to establish the context and purpose of the program. Management support can be gained only if the program has an appropriate context and purpose.
Risk management must operate at multiple levels, including strategic as well as operational. The effectiveness of risk management depends on how well risk management is integrated into an organization's culture and the extent to which risk management becomes everyone's responsibility.
