3.Risk Identification

Question 1

Identification Of Assets

Input

Answer 1

Scope and boundaries for the risk assessment to be conducted, list of constituents with owners, location, function, etc.

Question 2

Action

Answer 2

The assets within the established scope should be identified.

Question 3

Implementation guidance

Answer 3

An asset is anything that has value to the organization and which, therefore, requires protection. Asset identification should be performed at a suitable level of detail that provides sufficient information for the risk assessment.

The level of detail used on the asset identification influences the overall amount of information collected during the risk assessment. The level can be refined in further iterations of the risk assessment.
An asset owner should be identified for each asset, to provide responsibility and accountability for the asset.

Question 4

Output

Answer 4

A list of assets to be risk-managed, and a list of business processes related to assets and their relevance.

Question 5

Identification Of Threats

Input

Answer 5

Information on threats obtained from incident reviewing, asset owners, users and other sources, including external threat catalogues.

Question 6

Action

Answer 6

Threats and their sources should be identified.

Question 7

Implementation guidance

Answer 7

A threat has the potential to harm assets such as information, processes and systems and, therefore, organizations. Threats can be of natural or human origin, and can be accidental or deliberate. Both accidental and deliberate threat sources should be identified.
A threat can arise from within or from outside the organization.

Question 8

Output

Answer 8

A list of threats with the identification of threat type and source.

Question 9

Identification of existing Controls

input

Answer 9

Documentation of controls, risk treatment implementation plans.

Question 10

Action

Answer 10

Existing and planned controls should be identified.

Question 11

Implementation guidance

Answer 11

Identification of existing controls should be made to avoid unnecessary work or cost, e.g. in the duplication of controls.

In addition, while identifying the existing controls, a check should be made to
ensure that the controls are working correctly — a reference to already existing ISMS audit reports should limit the time expended in this task.

If a control does not work as expected, this can cause vulnerabilities.
An existing or planned control can be identified as ineffective, or not sufficient, or not justified.

Question 12

Output

Answer 12

A list of all existing and planned controls, their implementation and usage status.

Question 13

Identification Of Vulnerabilities

input

Answer 13

A list of known threats, lists of assets and existing controls.

Question 14

Action

Answer 14

Vulnerabilities that can be exploited by threats to cause harm to assets or to the organization should be identified.

Question 15

Implementation guidance:

Answer 15

Vulnerabilities can be identified in following areas:
— organization;
— processes and procedures;
— management routines;
— personnel;
— physical environment;
— information system configuration;
— hardware, software or communications equipment;
— dependence on external parties.

The presence of a vulnerability does not cause harm in itself, as there needs to be a threat present to exploit it. And can be found in physical environment, personnel, hardware, software and organization.

Question 16

Output

Answer 16

A list of vulnerabilities in relation to assets, threats and controls.

Question 17

Identification Of Consequences

input

Answer 17

A list of assets, a list of business processes, and a list of threats and vulnerabilities, where appropriate, related to assets and their relevance.

Question 18

Action

Answer 18

The consequences that losses of confidentiality, integrity and availability may have on the assets should be identified.

Question 19

Implementation guidance

Answer 19

A consequence can be loss of effectiveness, adverse operating conditions, loss of business, reputation, damage, etc.
This activity identifies the damage or consequences to the organization that can be caused by an incident scenario.

An incident scenario is the description of a threat exploiting a certain vulnerability or set of vulnerabilities in an information security incident. The impact of the incident scenarios is to be determined considering impact criteria defined during the context establishment activity.

assets can have assigned values both for their financial cost and because of the business consequences if they are damaged or compromised.
Organizations should identify the operational consequences of incident scenarios in terms of (but not limited to):
— Investigation and repair time;
— (work)time lost;
— opportunity lost;
— health and safety;

Question 20

Output

Answer 20

A list of incident scenarios with their consequences related to assets and business processes.