External (Internet If yes, there are significantly more threats that may Facing) exploit any vulnerabilities found in plan. Internal (e.g. Accidental: Are controls in place to mitigate vulnerabilities found user or privileged user that could come from internal network or accidental makes mistakes mistakes? affecting data integrity). Impact Risk Score Matrix Low Medium High Low 1 2 3 Medium 2 4 6 Likelihood High 3 6 9 Very high 4 8 12 Note 1: When calculating risk use the above numbers for assigning risk totals: 1-3 risk is Low, Yellow 4 risk is Medium and Red 6-12 risk is High. Note 2: When the ePHI data fields used, the impact is medium (2) if it not result in loss of ePHI or PII in excess of 500 record and ”will the impact is high if it result in loss of ePHI or PII in excess of 500 records”. If the likelihood is low (1) or medium (2). “may Medium impact (2) × Medium Likelihood (2) = (4) Medium Risk. Review the Likelihood ratings related to vulnerabilities found and Mitigations that can be used to reduce the likelihood and Impact. Definition: Risk is the combination of Probability-likelihood of and its consequences-impact (Impact is calculated first using Table 2. Then the probability-likelihood is calculated from Table 4). Impact * Likelihood = Risk for each threat or vulnerability the above plan. Security Analyst Name: Risk Scoring:
External (Internet Facing) If yes, there are significantly more threats that may exploit any vulnerabilities found in plan. Internal (e.g. Accidental: user or privileged user makes mistakes affecting data integrity). Are controls in place to mitigate vulnerabilities found that could come from internal network or accidental mistakes? Risk Score Matrix Impact Low Medium High Likelihood Low 1 2 3 Medium 2 4 6 High 3 6 9 Very high 4 8 12 Note 1: When calculating risk use the above numbers for assigning risk totals: 1-3 risk is Low, Yellow 4 risk is Medium and Red 6-12 risk is High. Note 2: When the ePHI data fields used, the impact is medium (2) if it ”will not result in loss of ePHI or PII in excess of 500 record and the impact is high if it “may result in loss of ePHI or PII in excess of 500 records”. If the likelihood is low (1) or medium (2). Medium impact (2) × Medium Likelihood (2) = (4) Medium Risk. Review the Likelihood ratings related to vulnerabilities found and Mitigations that can be used to reduce the likelihood and Impact. Definition: Risk is the combination of Probability-likelihood of and its consequences-impact (Impact is calculated first using Table 2. Then the probability-likelihood is calculated from Table 4). Impact * Likelihood = Risk for each threat or vulnerability the above plan. Security Analyst Name: Risk Scoring:
p392-cybersecurity-plan.docx