Hardware Failure/Service Example: Config files stored Monitor and maintain Loss share on network attached to storage space. storage (NAS) - no data integrity weekly. control over external Ensure backups are hardware or service recoverable. loss. Lab Computers Key person dependency Accept No funding for Maintain as best we can additional with current staffing. University limited High Level of Dependence Example: Compliance Transferred access data on External transfer – requirement protecting data to third sensitive data, Resources/Department university contracted research data. provider/vendor. This sensitive data on servers that are externally managed by contracted external Service level agreements in place. Example: Inadequate Access Control Compliance Begin quarterly Avoid and requirement and of access control lists. mitigate good business practice *Risk Response is the stated decision of accepting, avoiding, mitigating, sharing, or transferring an identified risk to organizational operations. See for expanded definitions. The final section of the IT risk assessment process should be considered an executive summary of risks to organizational critical information assets and the actions proposed to respond to those risks. The first step of the executive summary will require a review of previously identified risks to critical IT assets and the status of the proposed solutions which were documented in the last ITRA conducted. The final step is to document the proposed solutions for the risks noted in Step 4, for which the risk response is either or mitigate, share, transfer. Step 5 - Executive Summary Proposed risk solution(s), past and present If this is an IT risk assessment, skip to step 5b. Note: initial 5a. Status of proposed risk solution from previous IT risk assessment
Hardware Failure/Service Loss Example: share Config files stored on network attached storage (NAS) - no control over external hardware or service loss. Monitor and maintain to storage space. data integrity weekly. Ensure backups are recoverable. Lab Computers Key person dependency Accept No funding for additional Maintain as best we can with current staffing. University limited access data – sensitive data, research data. High Level of Dependence on External Resources/Department Example: transfer Compliance requirement Transferred protecting data to third university contracted provider/vendor. This sensitive data on servers that are externally managed by contracted external Service level agreements in place. Inadequate Access Control Example: Avoid and mitigate Compliance requirement and good business practice Begin quarterly of access control lists. *Risk Response is the stated decision of accepting, avoiding, mitigating, sharing, or transferring an identified risk to organizational operations. See for expanded definitions. The final section of the IT risk assessment process should be considered an executive summary of risks to organizational critical information assets and the actions proposed to respond to those risks. The first step of the executive summary will require a review of previously identified risks to critical IT assets and the status of the proposed solutions which were documented in the last ITRA conducted. The final step is to document the proposed solutions for the risks noted in Step 4, for which the risk response is either mitigate, share, or transfer. Step 5 - Executive Summary Proposed risk solution(s), past and present Note: If this is an initial IT risk assessment, skip to step 5b. 5a. Status of proposed risk solution from previous IT risk assessment
sample_ITRA_template_10Feb2015.docx