Prioritize and select controls to treat risks in alignment with Qatar National Information Assurance Framework Define and clearly indicate the risk-acceptance conditions and approval process Establish an effective and efficient method of communicating and managing risk Define procedures to monitor the risks and review ISRM cycle Changes in the business or legal/regulatory environment shall warrant the need to do information security risk assessment; and Although all State Agencies / organizations’ employees, contractors, partners and suppliers have a role in the management of information security risk, responsibility shall rest within State Agencies / organization’s management / Board of Directors Appendix B – Information Security Risk Management Criteria Information security risk management criteria(s) mentioned below is indicative, state agencies or constituencies may alter the rating / scale in accordance with the organizational policies or requirements. Information Asset Valuation Rating Category Information Asset Valuation Criteria / Rating Very High (4) High (3) Medium (2) Low (1) Financial Replacement value of the asset - the cost of recovery cleanup and replacing the information (if at all possible) Intolerably high costs; Significant impact to organization (greater than QAR 2M) Cost is hardly tolerable; High impact to organization (QAR 1M-QAR 2M) Moderate impact to organization (QAR 1M) Negligible impact to organization (Less than QAR 500K) Business Business consequences of loss or compromise of the information asset Very high (e.g. 80 to 100% of the overall service or production) High (e.g. 50 to 80% of the overall service or production) Medium (e.g. 30 to 50% of the overall service or production) Low (e.g. 0 to 30% of the overall service or production) Dependencies - relevant and numerous processes supported by the information asset Information asset supports more than 10 high critical business processes Information supports between 5 and 10 critical business processes Information asset supports between 1 and 5 less critical business processes Information asset does not support critical business processes If the information asset is compromised, how long will it take to have an Very short period (e.g. seconds or minutes) Short period (e.g. hours) Medium period (e.g. days) Long period (e.g. weeks or months)
impact on the organization? Legal / regulatory or regulatory consequences from the disclosure, modification, non-availability and/or destruction of the information asset Restriction of license or loss of licenses Central Bank, Ministry of Business & Trade and other regulatory bodies) report with major observations and heavy penalty / fine imposed (e.g. greater than QAR 5M) report with observations and penalty / fine of less amount (e.g. less than QAR 5M) report with minor observations resulting in government warning / notice Vulnerability Factor Rating Vulnerability Factors / Rating Very High (4) High (3) Medium (2) Low (1) Ease of discovery - How easy is it for this group of threat agents to discover this vulnerability? Detailed knowledge about the information asset is required e.g. professional experience General knowledge about the information asset is sufficient e.g. training Can be done with knowledge about the information asset e.g. procedure / manual Can be done without any knowledge about the information asset Ease of exploit - How easy is it for this group of threat agents to actually exploit this vulnerability? Special equipment and expertise required Generally available equipment can be used and special required without any additional equipment used or basic skill required Automated tools available or no specific skill required Awareness - How well known is this vulnerability to this group of threat agents? Unknown – zero day Known only to information security experts Known only to information security experts and users public knowledge Threat Likelihood (TL) Rating Threat Likelihood Rating Consideration Frequency Very Unlikely (VU) 1 The capability of the threat is limited, and compensating controls are in that effectively reduces the probability of vulnerability exploitation Once a year or null Unlikely (U) 2 The capability of the threat is medium, and implemented compensating Between 1 and 10 times per year