This information was used to determine what is working in the community and where the community could benefit from a self-directed comprehensive information security risk assessment. The integrity, availability, and confidentiality of information are critical to organizations missions. However, few organizations focus on their most important information assets when they make decisions about protecting their information. For example, a bank might consider its customers bank records to be one of its important information assets. Likewise, a military organization responsible for deploying troops might consider logistical data to be an important information asset.
Most organizations form their protection strategies by focusing solely on infrastructure weaknesses.
Those organizations fail to establish the effect of the infrastructure weaknesses on information assets, such as bank records or logistical data. It is not clear if important information is being adequately protected. Likewise, significant effort might be directed toward protecting relatively unimportant information. In these situations, the operational or business units of the organization and the information technology department are not communicating effectively. Often, information protection decisions are made in an ad hoc manner, based on the IT department s prior experience with vulnerabilities and the threats that they currently know about.