Team: Chose an industry listed in the DBIR $$ e$.$g$.,$ Health, Education,

Manufacturing, etc.

$2.$ Imagine a fictitious company within your industry sector, & briefly describe

its basic demographics $($context$)$ e$.$g$.,$ sector, company name, size, location, #

of employees, domestic or global, etc.

A$.$ Determine what you feel your organization$$s risk appetite$/$tolerance might be$.$

B$.$ Explain what factors might influence it$.$

$3.$ Create an inventory of information assets that your organization could be

expected to have. Prioritize these noting the approach & criteria applied.

A$.$ For each asset category, consider the types of threats that could potentially

affect each asset type resulting in risk to your organization. Note actors,

motivations & tactics that might come into play.

B$.$ For each threat, list possible strategies & controls that could mitigate the risk.

Exercise $$ Putting A Plan Together

$1$

$2$

$9/21/2023$

$2$

$3.$ Management has asked your team to develop & present a plan for

identifying & assessing the organization$$s information security risk.

A$.$ Outline how you would approach this task, where you would start and

the process you would follow.

B$.$ Discuss risk management framework options. Which seem better

suited to your organization? Why?

C$.$ What resources could you use to get a better sense of potential types

of threats to your organization$$s assets & the level of risk posed by

each? What preliminary information can you share?

D$.$ List the stakeholders $($individuals$/$teams$)$ that should be involved;

briefly note the roles & responsibilities each would have & why each is

important.

E$.$ Describe how you will present results to management. What details

should the results contain? What value will these results provide for

the organization?