Comparing risk and IT risk

For any organization, risk could be the probability of having an adverse impact on the goals or outcome of an organization. As we learned in the earlier chapters, there could be risks related to geography, market, operations, finance, reputation, technology, natural disasters, and more.

IT risk is a subset of the overarching world of risk. It is the probability that a threat will exploit an information system vulnerability and could lead to the loss of IT systems, unauthorized disclosure/modification/destruction/loss of information, errors and omissions, or failure to run the operations successfully.

ISACA has also published a risk IT framework. It defines the IT risk for an organization as “the business risk associated with the use, ownership, operation, involvement, influence, and adoption of IT within an enterprise. IT risk can be categorized into IT benefit/value enablement risk, IT programme and project delivery risk, and IT operations and...