Project 13.3: Assessing Risk Management According to the FFIEC Information Security InfoBase Handbook ( Appendix A ), the initial step in a regulatory Information Technology Examination is to interview management and review examination information to identify changes to the technology infrastructure, new products and services, or organizational structure.

1. Explain how changes in network topology, system configuration, or business processes might increase the institutions information securityrelated risk. Provide examples.

2. Explain how new products or services delivered to either internal or external users might increase the institutions might increase the institutions information securityrelated risk. Provide examples.

3. Explain how loss or addition of key personnel, key management changes, or internal reorganizations might increase the institutions information securityrelated risk. Provide examples.