M3D1: Risk Management Methods

This activity will address module outcomes 1, 2, 3, and 4. Upon completion of this activity, you will be able to:

• Identify the need for effective risk management. (CO 1, 4, 5, 6)
• Discuss various risk assessment models. (CO 1, 4, 6)
• Analyze how leaders and organizations may manage risk differently. (CO 1, 5)
• Define the term risk. (CO 4)

Business leaders have discovered over time, that with the increase of sophisticated cyber attacks, they must integrate risk management into daily operations. Many organizations are attempting to manage similar types of risks that other agencies also face, but that is not always the case. It is important to remember that risk and assets are defined by each individual organization. As a result, depending on the business objectives, leaders may adopt different risk assessment methodologies.

Review the following four approaches to risk assessment and answer the discussion questions.

• The Facilitated Risk Analysis Process (FRAP)
  Peltier, T. R. (2000). The Facilitated Risk Analysis Process (Links to an external site.) [PDF file size 193 KB]. Retrieved from http://www.ittoday.info/AIMS/DSM/85-01-21.pdf
• The NIST Cybersecurity Framework
  National Institute of Standards and Technology. (2014, February 12). Framework for improving critical infrastructure cybersecurity (Links to an external site.) [PDF file size 930 KB]. Retrieved from https://web.archive.org/web/20170624195120/https://www.nist.gov/sites/default/files/documents/cyberframework/cybersecurity-framework-021214.pdf (Links to an external site.)
• Energy Sector Risk Management Framework.
  Hoffman, P. A. (2012). Electricity Subsector cybersecurity risk management process (Links to an external site.). Federal Register (National Archives & Records Service, Office of the Federal Register), 77(100), 30517-30518. Retrieved from http://vlib.excelsior.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bth&AN=76338659&site=eds-live&scope=site
• NIST Risk Management Guide for Information Technology Systems
  Stoneburner, G., Goguen, A., & Feringa, A. (2002, July). Risk management guide for information technology systems (Links to an external site.) [PDF file size 737 KB]. Retrieved from http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf

After examining the various frameworks, respond to the following:

• Compare and contrast two of these methodologies, focusing on how they meet an organization’s needs. What are some similarities and differences? Why are they important to consider?
• Outline two different types of risk assessment methodologies.

Keep the following points in mind:

• Different risk assessment methodologies are identified, compared, and explained accurately.
• Examples are pertinent and explained well.