Fundamentals of Information Systems Security, 4th Edition

The Risk Management Process

FIGURE 3-1 shows the risk management process, which is one that never really ends. It is important to periodically move through the complete cycle to be ready for current threats, especially any new threats that may have emerged since the last pass through the cycle. The process defines how the steps of managing risk for an organization will be carried out. For example, the approach could state that risk analysis will be conducted at specified intervals, using tools that can include the documents that define, categorize, and rank risks. This approach is consistent with the Project Management Institute’s (PMI’s) Project Management Body of Knowledge (PMBOK). The PMI approach is not the only way to do things; however, ...