Sample NVA Report 233
Finding 3. Risk Analysis Procedure
In an open model where the internal users are assumed to be trusted, it is
imperative that there is a process by which any additional protection measures
are applied to resources. This process must include a risk analysis to determine
the value of the resource and the cost of the protection measure in order to
justify the imposition of additional controls on a user community that is
normally trusted. When questioned in interviews, it became apparent that
there was no risk analysis occurring prior to the imposition of controls.
Urgency Rating****
Risk
Without performing at least a basic risk analysis, controls may be placed on
systems that do not need them, and needed controls may not be applied ...