IT Risk Assessment

---

Determining actual and potential vulnerabilities in your IT infrastructure is critical to ensuring that company operations run smoothly today and in the future. Performing an information security risk assessment evaluates the degree to which your IT systems are susceptible to attacks and breaches, measures the financial consequences that breached data can have on the company, and identifies the appropriate steps to take to protect systems and their sensitive data.

When’s the Best Time to Conduct a Risk Assessment?

Because information security risk is not static, risk assessments should be performed throughout the lifecycle of a company’s IT infrastructure.

Performing a risk assessment before and after an upgrade, for example, will ensure that new vulnerabilities were not added along with the new hardware systems and software applications. Risk assessments conducted at periodic intervals can determine how well your IT infrastructure can defend itself against the ever-changing nature of attacks lurking on the dynamic information technology threat landscape.

IT risk assessments are the next step after performing a business impact analysis (BIA). Once you've performed a BIA on your organization and have analyzed critical business functions and identified the impact a loss of those functions could have on your organization, you can begin your IT risk assessment.

The first thing you should do when performing a risk assessment is gather information about possible threats to your organization. This can include :

• System-related information, such as information about hardware, software and data
• Business-related information, such as company records, experience of vendors doing business with the firm and experience of key stakeholder organizations
• Natural-related information, such as national weather service historical data and geological survey maps

Next, you should identify any threats that could affect your organization based on your list. Common threat sources include natural threats, such as floods and earthquakes; human threats, such as inadvertent data entry; and environmental threats, such as long-term power failure and pollution. Once you've identified potential threats, you can assess weaknesses in your IT system that could allow these potential threats to turn into disasters.

After assessing threats and weaknesses, the next step is to perform a risk analysis that will tell you the likelihood one of these events will occur and the severity of its consequences.