Is SOMAP good for risk assessment or it is not in use any more?
Is there any other Open Source IT Risk Management?
-
Lots of InfoSec risk frameworks are available. I'm unsure how SOMAP improves on the general access to something like NIST 800-30 and NIST 800-39, for instance.– schroeder ♦Nov 20, 2015 at 16:07
Add a comment
|
2 Answers
After skimming the documents, I cannot recommend SOMAP as a guide for risk. I have not reviewed the software, but the guidance on risk in the documents is too cursory to be useful. Also note that the guides for SOMAP have not been updated since their original version published in 2006.
There are lots of IT Risk methodology options for you to look at in varying degrees of complexity, focus, and in availability (free/paid):
answered Nov 20, 2015 at 16:24
Not very familiar with SOMAP. But I have worked on ISO 27001, NIST 800-30 and IRAM2. So would add IRAM2 methodology by ISF to the list, which IMHO is robust from a methodology perspective and also provides excel based workbooks that helps implement the methodology.
https://www.securityforum.org/tool/information-risk-assessment-methodology-iram2/
SureCloud is a solution that provides the online version of IRAM2, an an alternative to the ms-excel based workbooks.
https://www.digitalmarketplace.service.gov.uk/g-cloud/services/841278684438324
-
1IRAM is a product, not a framework or methodology (despite its name). You can't "do" IRAM without the product.– schroeder ♦Jan 27, 2021 at 20:13
-
According to Information Security Forum, IRAM2 is a methodology. As I have mentioned in my post, ISF has the excel based tool to implement the methodology. SureCloud is a vendor that also helps implementing the web based version of it. UK Gov has a large implementation of this methodology and I know that PwC and KPMG are leading consulting firms among the Big4 that I have seen implement this methodology for their clients.– Stan SamJan 27, 2021 at 20:49
-
1But can you use the methodology without the ISF tool? When I checked last year, you needed the tool from the ISF if you were a member, and once you ceased being a member, you couldn't use IRAM.– schroeder ♦Jan 27, 2021 at 20:57
-
1IRAM is also not "open source" as the OP asked. It's very proprietary. It's very, very expensive, too. £1k/mo for the online tool, and ISF membership is more than that.– schroeder ♦Jan 27, 2021 at 20:58
-
From the definition of "open", yea.. that makes sense.. but it fits the definition of a methodology you can implement using the tools such as ServiceNow, MetricStream, Resolver or other tools available in the market. For sure you need a subscription and support when implementing.. but yes, that definitely takes into account the size of the organization, where it needs to be implemented.– Stan SamJan 27, 2021 at 21:02