Đang chuẩn bị liên kết để tải về tài liệu:
Risk Management Guide for Information Technology Systems phần 4

chức năng là giảm chi phí gia tăng an ninh thực hiện chính sách, thủ tục bổ sung và chi phí thuêlàm việc này có bản quyền. Ngoài việc được phép sử dụng theo Luật Bản quyền 1968, không có một phần có thể được tái tạo bởi bất kỳ quá trình mà không có sự cho phép bằng văn bản | 3.8 STEP 8 CONTROL RECOMMENDATIONS During this step of the process controls that could mitigate or eliminate the identified risks as appropriate to the organization s operations are provided. The goal of the recommended controls is to reduce the level of risk to the IT system and its data to an acceptable level. The following factors should be considered in recommending controls and alternative solutions to minimize or eliminate identified risks Effectiveness of recommended options e.g. system compatibility Legislation and regulation Organizational policy Operational impact Safety and reliability. The control recommendations are the results of the risk assessment process and provide input to the risk mitigation process during which the recommended procedural and technical security controls are evaluated prioritized and implemented. It should be noted that not all possible recommended controls can be implemented to reduce loss. To determine which ones are required and appropriate for a specific organization a cost-benefit analysis as discussed in Section 4.6 should be conducted for the proposed recommended controls to demonstrate that the costs of implementing the controls can be justified by the reduction in the level of risk. In addition the operational impact e.g. effect on system performance and feasibility e.g. technical requirements user acceptance of introducing the recommended option should be evaluated carefully during the risk mitigation process. Output from Step 8 -Recommendation of control s and alternative solutions to mitigate risk 3.9 STEP 9 RESULTS DOCUMENTATION Once the risk assessment has been completed threat-sources and vulnerabilities identified risks assessed and recommended controls provided the results should be documented in an official report or briefing. A risk assessment report is a management report that helps senior management the mission owners make decisions on policy procedural budget and system operational and management changes. .