Survey of Security Risk Management Practices

LSI security risk management process and defined risk management as an ongoing process with four primary phases:

1. Assessing Risk: Identify and prioritize risks to the business.
2. Conducting Decision Support: Identify and evaluate control solutions based on a defined cost-benefit analysis process.
3. Implementing Controls: Deploy and operate control solutions to reduce risk to the business.
4. Measuring Program Effectiveness: Analyze the risk management process for effectiveness and verify that controls are providing the expected degree of protection.

The overall risk management process comprises four primary phases: Assessing Risk, Conducting Decision Support, Implementing Controls, and Measuring Program Effectiveness. Our risk management process illustrates how a formal program provides a consistent path for organizing limited resources to manage risk across an organization. The benefits are realized by developing a cost-effective control environment that drives and measures risk to an acceptable level.

The Assessing Risk phase represents a formal process to identify and prioritize risks across the organization. The LSI security risk management process provides detailed direction on performing risk assessments and breaks down the process in the Assessing Risk phase into the following three steps:

1. Planning. Building the foundation for a successful risk assessment.
2. Facilitated data gathering. Collecting risk information through facilitated risk discussions.
3. Risk prioritization. Ranking identified risks in a consistent and repeatable process.

During the Conducting Decision Support phase, the Security Risk Management Team must determine how to address the key risks in the most effective and cost efficient manner. The end result will be clear plans to control, accept, transfer, or avoid each of the top risks identified in the risk assessment process. The six steps of the Conducting Decision Support phase are:

1. Define functional requirements.
2. Select control solutions.
3. Review solutions against the requirements.
4. Estimate the degree of risk reduction that each control provides.
5. Estimate costs of each solution.
6. Select the risk mitigation strategy.