Its unauthorized disclosure could seriously and adversely impact the school, its students and their parents, its teachers and administrators, and the school board. After all data is categorized, the next step is to assess the potential threats to the data assets from inside and from outside the system. To ensure protection of all information assets each network administrator should maintain an inventory of information systems. This inventory should indicate all existing hardware, software, automated files, databases, and data communications links. Once the data or information is identified and categorized, the next step is to look at the data and assess what the potential threat risk to the information.
All information is assessed individually according to an agreed upon scale of risk.
The following is an example of a Risk Profile Matrix to Assist Administrators in their risk assessment of their system. Multiply Consequences rating by Sensitivity rating. After policy makers decide what level of risk that they are working with, they will then need to decide which defenses are most applicable to their situation and level of risk. The vulnerabilities are listed in the first column. The defenses against these vulnerabilities are listed in the second column.