This chapter reviewed risk management and contingency planning concepts. The RM process helps an organization understand the risks that it faces each day. It also helps organizations strengthen their security posture in response to threats and vulnerabilities. Many laws require organizations to use RM concepts to create information security programs.

This chapter also reviewed different types of contingency plans. An organization uses contingency plans to limit financial loss because of an adverse event. Contingency plans help minimize the length of time that an organization’s services and critical processes are interrupted after an emergency.