CONTENTS
Chapter 2: Risk Assessment Methodologies
Publicly available risk assessment standards
Qualitative versus quantitative
Qualitative risk analysis – the ISO27001 approach
Other risk assessment methodologies
Chapter 3: Risk Management Objectives
Information security risk management objectives
Chapter 4: Roles and Responsibilities
Other roles and responsibilities
Chapter 5: Risk Assessment Software
Vulnerability assessment tools
Risk assessment tool descriptions
Chapter 6: Information Security Policy and Scoping
Chapter 7: The ISO27001 Risk Assessment
Overview of the risk assessment process
What about duplicate copies and backups?
Identification of existing controls
Chapter 9: Threats and Vulnerabilities
Chapter 10: Impact and Asset Valuation
Business, legal and contractual impact values
Information to support assessments
Chapter 13: Risk Treatment and the Selection of Controls
Risk assessment and existing controls
Chapter 14: The Statement of Applicability
Drafting the Statement of Applicability
Chapter 15: The Gap Analysis and Risk Treatment Plan
Chapter 16: Repeating and Reviewing the Risk Assessment
Appendix 1: Carrying out an ISO27001 Risk Assessment using vsRisk™
Start using vsRisk™ for your risk assessment
Identify and evaluate options for the treatment of risks
Select control objectives and controls for treatment of the risks