RISK MANAGEMENT

You are the network administrator for CyberTech Corporation, Inc., who is hoping to win a contract with the U.S. Government. If it does, you would be the leader on a project that involves expanding an existing network by approximately 30% capacity in terms of bandwidth and storage. You have just left a four-hour meeting where you described the network expansion project to your colleagues. You explained the architecture, new enterprise level firewall, additional requirements for network monitoring and maintenance, the need for an additional system administrator, and the risks of not complying with Federal Information Security Management Act (FISMA) regulations for securely trading with the U.S. Government.

Your Task Before proceeding with the expansion project, management has tasked you to lead a team that will estimate the risks associated with this project. They want you to provide a high-level summary of both the quantitative and qualitative risks associated with the following items:

The project implementation deadline occurs in 9 months. Each month after the deadline is missed, a penalty of $100,000 is assessed. Three months after the deadline, the contract will be cancelled.

Several new network storage, security, and throughput hardware appliances need to be installed and configured. This raises the question whether there is room/power/personnel to support this new hardware.

Complying with FISMA is a new venture for your organization. What risks does that involve?

Prepare a report addressing these items in sufficient detail to (1) demonstrate your understanding of the differences between qualitative and quantitative risk assessments, and (2) address the three expressed concerns management has before agreeing to this contract.