Understanding the risk management life cycle
The risk management process is cyclical, and risks need to be identified on an ongoing/constant basis. Business practices may change and regulatory compliance may place fresh demands on security professionals. These changing practices will mean the organization must constantly assess the security posture to ensure controls and best practices are put into place. Figure 13.9 shows the stages of the risk management life cycle:
Figure 13.9 – Risk management life cycle
Within the risk management life cycle, an enterprise will perform the following activities:
- Identify—The business process, people, technology, and intellectual property (IP) are just some items that may constitute enterprise risk.
- Assess—In this phase, we must identify potential threats, vulnerabilities, and the level of risk that they pose to the enterprise.
- Control—During this phase, we identify controls that...
