Risk Assessment

---

The purpose of risk assessment is quite simple – it is to help stakeholders in their decision making process, with regard to security control requirements and to provide assurance on the effectiveness of those controls that are already in place.

The majority of risk assessment methods have limitations that result from the requirement to populate defined parameter fields that ultimately result in a risk score.  These approaches are useful in that they define a clear operating framework but tend to be generic in that they pretty much all use the same input parameter scales that take account of impacts, threats and vulnerabilities.  These approaches represent a great starting point and give useful structure to the risk assessment process.  They will also definitely meet the requirements of assurance approaches such as ISO27001.

What standard methodologies don’t tend to handle well is the complexity of modern enterprise technology operating models that are a constantly changing mix of traditional on-premise and cloud based solutions, managed by a range of different parties.  This means risk assessment approaches need to be flexible to cope with rapid change and scalable to ensure proportionate coverage that takes account of aspects such as existing supplier / service assurance aspects.

It is critical that approaches to risk assessment and management do not simply become ‘box ticking’ exercises and actually add true value to meeting Cyber Security objectives.  At Elite we will help you to go beyond the method to ensure you understand what real risk looks like and to provide clarity on when intervention is required.  We will also let you know when things are effective as risk assessment needs to tell us when we are doing things well and not just focus on the negatives.

Some of our most popular services in this critical success area are:

• Development of corporate risk strategy;
• Creation and application of tailored approaches to risk assessment that take account of business operating environment and constantly changing threat profile;
• Granular application from organisation-wide cyber risk assessments to specific system driven risk reviews at the detailed technical level;
• Confirmation of risk appetite, tolerance and residual risk, supporting risk mitigation decision making;
• Development of bespoke risk management strategies and methodological approaches;
• ISO27005 aligned approaches to support ISO27001 compliance;
• Data Protection Impact Assessments;
• Risk awareness training and support to ensure organisations can effectively apply our methodologies independently. iso 27001 computer security