Is SOMAP good for risk assessment or it is not in use any more?
Is there any other Open Source IT Risk Management?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityIs SOMAP good for risk assessment or it is not in use any more?
Is there any other Open Source IT Risk Management?
After skimming the documents, I cannot recommend SOMAP as a guide for risk. I have not reviewed the software, but the guidance on risk in the documents is too cursory to be useful. Also note that the guides for SOMAP have not been updated since their original version published in 2006.
There are lots of IT Risk methodology options for you to look at in varying degrees of complexity, focus, and in availability (free/paid):
Not very familiar with SOMAP. But I have worked on ISO 27001, NIST 800-30 and IRAM2. So would add IRAM2 methodology by ISF to the list, which IMHO is robust from a methodology perspective and also provides excel based workbooks that helps implement the methodology.
https://www.securityforum.org/tool/information-risk-assessment-methodology-iram2/
SureCloud is a solution that provides the online version of IRAM2, an an alternative to the ms-excel based workbooks.
https://www.digitalmarketplace.service.gov.uk/g-cloud/services/841278684438324