Reference no: EM133094916

Assessment Description

The purpose of this assignment is to develop a risk model, define the risk program goals, and communicate the program implementation strategy.

Establish a comprehensive security risk program for the organization. Write a executive summary that contains the following information.

Identify the regulatory compliance and control standards to which the company must adhere.

Risk Management Framework

Justify the selected risk management framework (e.g., NIST 800-37, OCTAVE Allegro, FAIR, FRAAP, NIST 800-30).

Define the steps within the risk management framework being adopted.

Include a workflow diagram (created from MS Vision, OpenDraw, or other drawing software) that illustrates how management will make effective decisions for each stage.

Describe how architecture and system updates will be selected and applied.

Risk Management Program

Explain how the SRR and TVM integrate into the framework (i.e. which steps are they integrated within, or which step do they follow after).

Discuss the life cycle for the program, including activities such as vulnerability management, risk identification, risk rating/prioritization, security risk review, architecture changes audits, etc.