That seems reasonable enough, but a relatively small percentage of organizations actually evaluate their systems this way. In fact, only 33 percent of companies have classified what information is most valuable, according to the InformationWeek study. The same situation is likely to be found in smaller companies as well. That's where risk analysis comes in. By using an established methodology for assessing your systems, data and networks, you can determine which computer resources are most at risk and which technology tools and practices will best protect them.
Many organizations turn to outside firms for risk analysis.
Common issues such consultants and specialists look for include misconfigured systems, poorly designed e-business infrastructures, and back doors into networks through partner connections. Internal IT staff might lack the expertise to locate such trouble spots, and they may also lack the objectivity to find flaws in systems they designed. The wee hours of the morning following an attack are no time to be deciding how to respond. Incident preparedness starts with identifying who should respond to an incident and what their roles should be. It often makes sense to designate a single person as the response coordinator.