page_title: IT risk management
section_title: Definitions
hierarchical_section_title: IT risk management / Definitions
caption_attribution_description: English: A picture showing the relationships of different security terms around security architecture
context_page_description: IT Risk Management is the application of risk management methods to information technology in order to manage IT risk, i.e.:
  The business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise or organization
  IT risk management can be considered a component of a wider enterprise risk management system.
  The establishment, maintenance and continuous update of an Information Security Management System provide a strong indication that a company is using a systematic approach for the identification, assessment and management of information security risks.
  Different methodologies have been proposed to manage IT risks, each of them divided into processes and steps.
  According to the Risk IT framework, this encompasses not only the negative impact of operations and service delivery which can bring destruction or reduction of the value of the organization, but also the benefit enabling risk associated to missing opportunities to use technology to enable or enhance business or the IT project management for aspects like overspending or late delivery with adverse business impact.
context_section_description: The Certified Information Systems Auditor Review Manual 2006 produced by ISACA, an international professional association focused on IT Governance, provides the following definition of risk management: "Risk management is the process of identifying vulnerabilities and threats to the information resources used by an organization in achieving business objectives, and deciding what countermeasures, if any, to take in reducing risk to an acceptable level, based on the value of the information resource to the organization."
  Risk management is the process that allows IT managers to balance the operational and economic costs of protective measures and achieve gains in mission capability by protecting the IT systems and data that support their organizations’ missions. This process is not unique to the IT environment; indeed it pervades decision-making in all areas of our daily lives.
  The head of an organizational unit must ensure that the organization has the capabilities needed to accomplish its mission. These mission owners must determine the security capabilities that their IT systems must have to provide the desired level of mission support in the face of real world threats. Most organizations have tight budgets for IT security; therefore, IT security spending must be reviewed as thoroughly as other management decisions. A well-structured risk management methodology, when used effectively, can help management identify appropriate controls for providing the mission-essential security capabilities.
  Risk management in the IT world is quite a complex, multi faced activity, with a lot of relations with other complex activities. The picture to the right shows the relationships between different related terms.
  The American National Information Assurance Training and Education Center defines risk management in the IT field as:
  The total process to identify, control, and minimize the impact of uncertain events. The objective of the risk management program is to reduce risk and obtain and maintain DAA approval. The process facilitates the management of security risks by each level of management throughout the system life cycle. The approval process consists of three elements: risk analysis, certification, and approval.
  An element of managerial science concerned with the identification, measurement, control, and minimization of uncertain events. An effective risk management program encompasses the following four phases:
  a Risk assessment, as derived from an evaluation of threats and vulnerabilities.
  Management decision.
  Control implementation.
  Effectiveness review.
  The total process of identifying, measuring, and minimizing uncertain events affecting AIS resources. It includes risk analysis, cost benefit analysis, safeguard selection, security test and evaluation, safeguard implementation, and systems review.
  The total process of identifying, controlling, and eliminating or minimizing uncertain events that may affect system resources. lt includes risk analysis, cost benefit analysis, selection, implementation and test, security evaluation of safeguards, and overall security review.
caption: Relationships between IT security entity
exif: {}