|
A complete and accurate Risk Inventory is a critical element of any good risk management program. Risk Inventories provide organizations with a vital list of assets/elements providing value to the organization, their associated characteristics, and their associated risks and issues. A Risk Inventory may be a list of Vendors with various attributes (name, address, type of service, types of data shared, contact information, etc.), as well as a list of all Applications that host various classes of data. Organizations commonly will build Risk Inventories to track projects, lists of customers, list of risks and threats, or any other items with corresponding attributes that are important to capture, track, and report against.
An inventory is the foundation of any Risk Management program. With a good risk inventory, the organization can gain a deeper understanding of the assets it possesses, their value, their interdependencies, and provides process owners with the information to make informed decisions about how risks should be treated.
|
|
|
|
|
An organization, for example, may have 500+ applications within their environment. However, most organizations will not have the resources to conduct assessments of all 500+ applications with the same level of detail & accuracy. Instead, they may decide to prioritize their efforts based on the type of data stored within an Application, and weigh whether the application requires a full-blown, a light assessment or no assessment at all. Or, similarly, if a certain vendor provides a critical service or transmits/stores sensitive data, that will help determine the need and depth of a contemplated assessment. In this way a Risk Inventory provides organization critical information about what they possess and which areas should draw the greater focus in terms of their risk management efforts.
Risk inventories also provide critical information for managing ongoing risk and compliance efforts. If a new regulation is passed requiring the protection of specific data types or services, organizations need a good inventory to determine the impact of the regulation and to properly plan and manage the compliance efforts.
Rsam provides a flexible Risk Inventory solution that allows organizations to quickly and easily track risk and compliance information for assets, processes, projects, initiatives, and more. Each element may be recorded on its own, or may be related to other assets or elements that support them, establishing critical links for related assets and risk elements.
|
|
|
|
