IT risk management
IT risk management is the practice of understanding the business goals and overall risk strategy, as well as guiding the IT strategy to align with organizational goals and priorities with minimal risk. The IT strategy needs to be supported by the available resources, technical maturity, and available budget.
Like enterprise risk management, IT risk management is a cyclical process that consists of the following steps:
Figure 3.2 – IT risk management life cycle
The following is a brief description of each step of the IT risk management life cycle:
- IT risk identification: This is the first step of IT risk management and includes determining the level of risk per the enterprise’s risk appetite and tolerance. It is important to document the risk identification efforts and include the major threats to organization assets, including people, processes, and technologies.
- IT risk assessment: This step requires analyzing...
