Prioritize and select controls to treat risks in alignment with Qatar National Information Assurance Framework Define and clearly indicate the risk-acceptance conditions and approval process Establish an effective and efficient method of communicating and managing risk Define procedures to monitor the risks and review ISRM cycle Changes in the business or legal/regulatory environment shall warrant the need to do information security risk assessment; and Although all State Agencies / organizations’ employees, contractors, partners and suppliers have a role in the management of information security risk, responsibility shall rest within State Agencies / organization’s management / Board of Directors Appendix B Information Security Risk Management Criteria – Information security risk management criteria(s) mentioned below is indicative, state agencies or constituencies may alter the rating / scale in accordance with the organizational policies or requirements. Information Asset Valuation Rating Information Asset Valuation Criteria / Very High (4) High (3) Medium (2) Low (1) Rating Category Replacement value of the Intolerably high Cost is hardly Moderate Negligible asset - the cost of costs; Significant tolerable; impact to impact to recovery cleanup and impact to High impact organization organization replacing the information organization to (QAR (Less than (if at all possible) (greater than organization 1M) QAR 500K) Financial QAR 2M) (QAR 1M-QAR 2M) Business consequences of Very high (e.g. High (e.g. 50 Medium (e.g. Low (e.g. 0 to loss or compromise of the 80 to 100% of to 80% of the 30 to 50% of 30% of the information asset the overall overall service the overall overall service or or production) service or service or production) production) production) Dependencies - relevant Information Information Information Information and numerous processes asset supports supports asset asset does supported by the more than 10 between 5 supports not support information asset high critical and 10 critical between 1 critical business business and 5 less business Business processes processes critical processes business processes If the information asset is Very short Short period Medium Long period compromised, how long period (e.g. (e.g. hours) period (e.g. (e.g. weeks or will it take to have an seconds or days) months) minutes)
Prioritize and select controls to treat risks in alignment with Qatar National Information Assurance Framework Define and clearly indicate the risk-acceptance conditions and approval process Establish an effective and efficient method of communicating and managing risk Define procedures to monitor the risks and review ISRM cycle Changes in the business or legal/regulatory environment shall warrant the need to do information security risk assessment; and Although all State Agencies / organizations’ employees, contractors, partners and suppliers have a role in the management of information security risk, responsibility shall rest within State Agencies / organization’s management / Board of Directors Appendix B – Information Security Risk Management Criteria Information security risk management criteria(s) mentioned below is indicative, state agencies or constituencies may alter the rating / scale in accordance with the organizational policies or requirements. Information Asset Valuation Rating Category Information Asset Valuation Criteria / Rating Very High (4) High (3) Medium (2) Low (1) Financial Replacement value of the asset - the cost of recovery cleanup and replacing the information (if at all possible) Intolerably high costs; Significant impact to organization (greater than QAR 2M) Cost is hardly tolerable; High impact to organization (QAR 1M-QAR 2M) Moderate impact to organization (QAR 1M) Negligible impact to organization (Less than QAR 500K) Business Business consequences of loss or compromise of the information asset Very high (e.g. 80 to 100% of the overall service or production) High (e.g. 50 to 80% of the overall service or production) Medium (e.g. 30 to 50% of the overall service or production) Low (e.g. 0 to 30% of the overall service or production) Dependencies - relevant and numerous processes supported by the information asset Information asset supports more than 10 high critical business processes Information supports between 5 and 10 critical business processes Information asset supports between 1 and 5 less critical business processes Information asset does not support critical business processes If the information asset is compromised, how long will it take to have an Very short period (e.g. seconds or minutes) Short period (e.g. hours) Medium period (e.g. days) Long period (e.g. weeks or months)
cs-information_security_risk_management_framework-appendix_eng_v1.2.docx