Summary
Risk management is about decision-making and taking actions to address uncertain outcomes, controlling how risks might impact the achievement of business goals.
ISRM is the process of identifying, evaluating, and treating risks around the organization’s valuable information. Confidentiality, integrity, and availability (CIA) are the criteria against which the information assets are assessed for risks. Risk management aims to address uncertainties around those assets to ensure the desired business outcomes are achieved.
ISO 31000:2018 is a recently updated version of the International Organization for Standardization (ISO) standard for risk management that defines risk as the effect of uncertainty on objectives.
Managing risk is an ongoing task, and its success will come down to how well risks are assessed, plans are communicated, and roles are upheld. Identifying the critical people, processes, and technology to help address these steps will create a solid foundation...
