Risk management framework
We briefly discussed the framework steps in our discussion of the responsibilities of tier 3. Now let us put those steps into practice. The following steps are used when evaluating an IT system, or environment, and ensuring that it has adequate controls implemented.
Prepare
This is where we gather the requirements for the project. Is the system going to be used for just our website or will credit cards flow through it? Will it store ePHI or intellectual property? All of these questions should be well thought out before you embark on standing up the system. It will end up costing you more in the long run if you do not properly plan for the company’s (and regulatory) requirements.
Categorize
Once we have prepared all of our requirements, we need to categorize the system. To do this, we will use the Confidentiality, Integrity, and Availability (CIA) triad. The CIA acronym stands for the following:
- Confidentiality: Protecting the information...
