Risk assessment (ID.RA)

Risk assessments assist in identifying risk throughout the organization. Risk identifiers can include vulnerabilities, threats, and understanding what the impact is from those identifiers. We must associate identified system risks with our risk register too for tracking and remediation purposes.

ID.RA-01

“Vulnerabilities in assets are identified, validated, and recorded.”

You will need a tool to help identify vulnerabilities and risks associated with your IT resources. This tool should be validated by outside third-party firms to ensure that you are receiving accurate and up-to-date information regarding the risks. There are several vulnerability scanners out there to choose from. Some require a fee or subscription, whereas others are free open source tools that you can use.

Pick a vulnerability scanner that will highlight risks associated with your IT resources. Not all scanners are created equal. PCI, for instance, requires that you...