Auditing IT Infrastructures for Compliance, 3rd Edition

IT Security Assessment Results: Risk, Threats, and Vulnerabilities

Any existing security assessment should include details about risk as part of the workpapers. Details include full documentation of the identified threats, vulnerabilities, and resulting risks. The findings inform management of the resulting risk to the environment. This information provides management with the data necessary to make informed decisions to manage risk. The results will help drive how resources are allocated to address potential uncertainties.

The key components of the assessment should include the following:

• Introduction—This provides the purpose and scope of the assessment. This includes the systems, personnel, locations, and other details about the assessed ...