Latest Research

Define the Information Security Risk Tolerance Level

Your best guess at what’s needed doesn’t cut it anymore.

Book This Workshop

Making risk decisions without a clearly defined risk tolerance can result in:

  • Inadvertent acceptance of dangerous risks
  • Spending security funds on ineffective controls
  • Ambiguous security risk responsibilities

Clear understanding of risk tolerance leads to:

  • Informed risk decisions
  • Efficient and effective rationale for security spend
  • Clearly assigned risk functions

Book Your Workshop

Onsite Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn’t enough, we offer low-cost onsite delivery of our Project Workshops. We take you through every phase of your project and ensure that you have a road map in place to complete your project successfully.

Book Now

Module 1: Assess the Risk Culture and Responsibilities

The Purpose

  • Discuss the general business requirements and obligations towards risk.
  • Understand and agree on risk responsibilities and duties.
  • Define and discuss security assumptions for frequency/impact.

Key Benefits Achieved

  • Clear understanding of risk language and responsibilities across the organization
  • Defined risk statement and IT mandate

Activities: Outputs:
1.1 Define the security executive function RACI chart.
  • Defined IT mandate
1.2 Assess employee and management risk culture.
  • IT and Business Leadership Alignment Report
1.3 Standardize impact and risk assumption terminology.
  • Information Security Risk Statement
1.4 Define risk requirements and risk frequency/impact thresholds.
  • Business Leadership Communication and Reporting Plan

Module 2: Define Risk Tolerance

The Purpose

  • Use risk definitions and understanding to define micro risk tolerance.
  • Define and discuss organizational risk tolerance for collective macro risk, and high-level strategy for macro risk management.

Key Benefits Achieved

  • Quantified definition for micro risk tolerance
  • Quantified methodology for risk impact analysis
  • Understanding and management method for macro risk

Activities: Outputs:
2.1 Perform risk scenario assessment.
  • Risk Tolerance Determination Tool
2.2 Define and discuss organizational micro risk tolerance.
2.3 Define and discuss macro risk tolerance and macro risk management methodology.
Visit our IT Cost Optimization Center
Over 100 analysts waiting to take your call right now: 1-519-432-3550 x2019