Criteria C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 C11 C12 Methods ISO/IEC RA/ RM on the N/A Low Low Standard Commercial No ISO/IEC 27005:2008 , agencies, / business 27001:2005, Qualitative harm Large ISO/IEC companies. 27002:2005 SME NIST RA/ RM Qualitative on open Type 1 Low Low ITC Free No ISO/IEC purpose agencies, damage Experts 27001:2005 scenarios Large companies OCTAVE General RA/ RM Qualitative on Type 4 Low Standard Free Yes / agencies, critical - assets Large companies. SME CRAMM RA/ RM Qualitative on open Type 1 Low Low ITC Commercial Yes / ISO/IEC purpose agencies, damage Experts 27002:2005 scenarios
Criteria Methods C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 C11 C12 ISO/IEC 27005:2008 agencies, Large companies. SME RA/ RM / Qualitative on the business harm N/A Low Low Standard Commercial No ISO/IEC 27001:2005, ISO/IEC 27002:2005 NIST agencies, Large companies RA/ RM Qualitative on open damage scenarios Type 1 Low Low ITC Experts Free No ISO/IEC 27001:2005 OCTAVE General purpose agencies, Large companies. SME RA/ RM Qualitative on critical assets Type 4 Low Standard Free Yes / - CRAMM agencies, RA/ RM Qualitative on open damage scenarios Type 1 Low Low ITC Experts Commercial Yes / ISO/IEC 27002:2005 purpose ,
D2.1_UPRC.docx