Patent ID: 7818249

Claim:
A method for assessing and/or managing risks for an organization, comprising the steps of: inventorying a plurality of assets of the organization, wherein each asset is defined to be one of an electronic asset type and a location asset type, and wherein the electronic asset type includes computers and networking equipment therefor and the location asset type includes physical locations where the electronic asset types are placed; identifying the plurality of assets, wherein at least a portion of the plurality of assets are identified by utilizing a computer to electronically scan the plurality of assets via a network; storing the identified assets electronically in the computer; identifying at least one criterion defining a security objective of the organization, and electronically storing the at least one identified criterion in the computer; identifying one or more inventoried assets that relate to the identified criterion by utilizing the computer; formulating one or more metric equations for each identified criterion by utilizing the computer, each metric equation being defined, in part, by the one or more identified assets, wherein each metric equation yields an outcome value when one or more measurements are made relating to the identified assets; and assessing the risk to the organization based on the measured values of the one or more metric equations by utilizing the computer.