For too long, information risk management has been lost in translation. Technical risk analyses were unintelligible to the business and even security practitioners lacked common terms, definitions, or analysis models. Without a working risk management framework, security and business leadership have found it hard to agree on priorities, policies, or budgets. Even security teams struggle prioritizing which controls to implement.
But this need no longer be the case. In this Chapter, we’ll learn how businesses can use the standard ISO 31000 Risk Management framework, ...
