Criteria Methods C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 C11 C12 ISO/IEC 27005:2008 agencies, Large companies. SME RA/ RM / Qualitative on the business harm N/A Low Low Standard Commercial No ISO/IEC 27001:2005, ISO/IEC 27002:2005 NIST agencies, Large companies RA/ RM Qualitative on open damage scenarios Type 1 Low Low ITC Experts Free No ISO/IEC 27001:2005 OCTAVE General purpose agencies, Large companies. SME RA/ RM Qualitative on critical assets Type 4 Low Standard Free Yes / - CRAMM agencies, RA/ RM Qualitative on open damage scenarios Type 1 Low Low ITC Experts Commercial Yes / ISO/IEC 27002:2005 purpose ,
companies Ebios agencies, Large companies, SME RA/ RM Qualitative Based on security needs Type 2 Low Standard Free Yes / Free ISO/IEC 27001:2005, ISO/IEC 27002:2005, ISO/IEC agencies, companies, SME RA/ RM Qualitative Based on open damage scenarios Type 5 Low Low Standard Free Yes / ISO/IEC 27001:2005, ISO/IEC 27002:2005 MAGERIT agencies, Large companies, SME RA/ RM / Qualitative Based on open damage scenarios Type 5 Low Low ITC Experts Free Yes / ISO/IEC 27001:2005, ISO/IEC ISO/IEC 27005:2008 MEHARI agencies RA/ RM Qualitative Based on fixed Type 1 Low Low ITC Experts Commercial Yes / Free ISO/IEC 27001:2005,
CIIP methodologies Availability CI Sector Stage ATHENA L 1,2,3,4,5,6,7,8,9,10,11,12,13 b CI3 L 1,2,4,5,6,7 c CIP/DSS L 1,2,3,4,5,6,7,9,10,11,12,13 a,c,d,e L 1,2,3,7,8,12,13 d,e DUTCH NRA L 1,3,4, 10,11,13 a,b,c C 8,11,13 a,b,c,d EMCAS C 1,7,12 a,b,c FAIT L 1,2,5,9 a,b FINSIM R 7,12 a,b FMEA/ FMECA C 6,7,11,12 a,b,c FORT-FUTURE L 1,2,3,4,5,6,7,9,10,11,12,13 a,b,c,e FTA C 6,7,11,12 a,b,c GIS Inter- operatibility R 9,10 c,e GoRAF R 1,4,6,8,11 b,c,d C 1,2,3,7,11,13 a,b,c IIM R 1,4,7,8,10,13 a,c,d INTEPOINT VU C 1,7,9,10,11 c LUND R 1,9,10 a,b MARGERIT V2 C 8,11,12,13 a,b,d MIA R 7,8,13 a,b MIN R 10,11 a MUNICIPAL R 1,7,8 a,c N-ABLE L 1,9,12 a,c,d,e NEMO L 1,2,4,9,13 c,d,e NSRAM R 1,7 c,d,e Risk Maps R 1,2,3,4,5,6,7,9,10,11,12,13 A TRAGIS L 9,10 A
References Reynolds, D., Rabey, K., Polemi, N.: Analysing mes needs and expectations in the area of information security. ENISA report (2008), available at . Polemi N., Ntouskas T., “Open Issues and Proposals in the IT Security Management of Commercial The S-PORT National Case”. In: D. Gritzalis, S. Furnell, and M. Theoharidou (Eds.): SEC 2012, IFIP AICT 376, pp. 567–572, 2012. Polemi, N.: Security Management of the ports’ information systems. ENISA Personal study. Available at (accessed August 2012). ISO/IEC. Information Technology - Security Techniques - Information Security Risk Management, ISO /IEC 27005, 2008. ISO/IEC. Information technology - Security techniques - Specification for an Information Security Management System, ISO/IEC 27001, 2005. ISO/IEC. Information technology - Security techniques - Code of practice for information security management, ISO/IEC 2005. ISO/IEC:17799: Information technology - security techniques - code of practice for information security management (2005), http://www.iso.org National Institute for Standards and Technology, Risk management for information technology systems, NIST Special Publication 800-30, USA, July 2002. OCTAVE Method Implementation Guide Version 2.0, Carnegie Mellon University, June 2001. Available at http://www.cert.org/octave/ (accessed December 2010). Alberts, Christopher & Dorofee, Audrey. Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Method Implementation Guide, v2.0. Software Engineering Institute, Carnegie Mellon University, 2001. . Insight Consulting, CRAMM User Guide, Issue 5.1, United Kingdom, 2005. Expression of Needs and Identification of Security Objectives PREMIER MINISTRE Secrétariat général de la défense nationale Direction centrale de la sécurité des systèmes d’information Sous-direction des opérations Bureau conseil. Available BSI Standard 100-1. (2005). Information Security Management Systems (ISMS). Retrieved May 2008, from www.bsi.bund.de BSI Standard 100-2. (2005). IT-Grundszchutz methodology. Retrieved May 2008, from BSI Standard 100-3. (2005). Risk analysis based on IT-Grundszchutz. Retrieved May 2008, from