2

I wouldn't bother asking this question if it was easy to find. In the past I've used a risk-analysis-checklist which was split up in serveral factors.

For example, there are Human factors, Hardware is one, Organization is one of them and Environment too.

I've lost this list and I wonder if anyone here could share this checklist with me. I've found a partial list in Dutch which helped me out for the factors except Organization and Environment.

If you have a question about my question(?), please add a comment and I will try to make it more clear.

Improve this question
4
  • Is the purpose of the checklist to quantitatively evaluate security risk? Or is it just supposed to remind you of what to look at?
    – KnightOfNi
    Apr 17, 2014 at 13:33
  • @KnightOfNi Pointing me in the right direction for Organization and Environment would be a start. The complete list would be even more great.
    – Rob
    Apr 17, 2014 at 13:38
  • 1
    Doesn't this depend a lot on what approach you're taking? Which framework are you using? ISO? COSO? ITIL? Was it a SANS publication?
    – Raystafarian
    Apr 18, 2014 at 14:55
  • The checklist I've had was based on either ISO or ITIL. But I'm just looking for the most basic checklist with examples of the most common risks. It does not have to be the exact list, pointing in the right direction with practical examples would be great. If you have any of them, please add them as answer even as they don't meet my request. They could gelp me alot!
    – Rob
    Apr 18, 2014 at 14:58

1 Answer 1

Reset to default
2

Sounds like what you're looking for is ISO/IEC 27002 - Information technology – Security techniques – Code of practice for information security management

Outline for ISO27002:2005

  1. Framework
  2. Acceptable Use of Information Technology Resources

  3. Information Security Definition & Terms

  4. Risk assessment

  5. Security policy – management direction
  6. Organization of information security – governance of information security
  7. Asset management – inventory and classification of information assets
  8. Human resources security – security aspects for employees joining, moving and leaving an organization
  9. Physical and environmental security – protection of the computer facilities
  10. Communications and operations management – management of technical security controls in systems and networks
  11. Access control – restriction of access rights to networks, systems, applications, functions and data
  12. Information systems acquisition, development and maintenance – building security into applications
  13. Information security incident management – anticipating and responding appropriately to information security breaches
  14. Business continuity management – protecting, maintaining and recovering business-critical processes and systems
  15. Compliance – ensuring conformance with information security policies, standards, laws and regulations
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .