Professional Documents
Culture Documents
IT Risk Assessment Process Template
IT Risk Assessment Process Template
Information Technology
Risk Assessment Template
Introduction
Virginia Tech's Office of Converged Technologies for Security, Safety, and Resilience (CTSSR)
recommends that university departments conduct an Information Technology Risk Assessment
(ITRA) on an annual basis. After the initial ITRA is conducted, an annual review resulting in
revisions to the previous year’s report is acceptable.
New for 2015 is Step 1a, an evaluation of critical security controls (CSC) from an organizational
perspective. These controls are considered the most effective measures for detecting, preventing,
responding and mitigating the most common IT security risks.
Step 4 has been updated to provide improved risk response reporting. Step 5 has been updated to
include a new section (5a) for monitoring the status of previously proposed risk solutions.
Please be sure to access the ITRA website to download the most current versions of forms and
templates, and follow the steps outlined in this document to complete an ITRA for your
organization.
Mission Statement:
Required – This should be the same as those
Essential Business Functions: defined in the organizational area/department
continuity documentation
From an organizational perspective, please rate the levels of awareness of the need for, and
adoption of the following critical security controls.
Awareness Levels:
High: Most in the organization are aware of the need for this security measure
Medium: Only IT personnel are aware of the need for this security measure
Low: Few in the organization are aware of the need for this security measure.
Adoption Levels:
High: Some form of implementation exists for this security measure
Medium: Planning for future implementation is underway.
Low: No plans to adopt this security measure.
In order to generate the most complete list of technology assets, it is helpful to use more than one
technique to gather information from personnel in the department or unit. Techniques for
gathering information could include group discussion, individual input, questionnaires,
interviews, etc.
Mission Critical – Mission critical assets are those technology assets that are highly
sensitive with respect to confidentiality, integrity, and/or availability, or which, if
compromised, could cause physical, financial, or reputational harm to the university, or
members of the university community (Policy 7105.) Lastly, an asset could be classified as
mission critical if it is subject to legislative, regulatory, and/or contractual compliance
requirements; or is involved in restricted research activities (as classified under the
International Traffic in Arms Regulations, ITAR).
Essential – The department could work around the loss of this information asset for several
days or perhaps a week, but eventually the technology asset would have to be restored to a
useable status.
Normal – The department as a whole can operate without this information asset for an
extended (though perhaps finite) period of time, during which particular units or individuals
may be inconvenienced and/or need to identify alternatives.
Further guidance for classifying critical assets can be found in Table 1 at:
http://www.it.vt.edu/ctssr/risk_assessment/itra_steps-1-2.php
Rearrange the technology assets listed in Step 1, such that departmental Mission Critical Assets
or External Dependencies are moved to the top of the table, Essential Assets appear second, and
Normal Assets appear at the bottom (using Table C, with each section expanded to have as many
rows as necessary):
Detailed information about how to rate likelihood and impact of risks and an explanation of risk
responses (required in Table E below) is available at:
http://www.it.vt.edu/ctssr/risk_assessment/understanding_risk/
Table D: Rating of probability / impact of potential risks for each mission critical asset
Rate the Likelihood Rate the Impact
Mission Critical Asset: of Risk of Risk
__________________________
POTENTIAL RISK High Medium Low High Medium Low
Lax or Dated System Administration
Practices
Inadequate Desktop Access Control
Management
Lax Operational Policies
Key Person Dependency
Lack of Strong Passwords
Inadequate Safeguards on Sensitive
Data
Inadequate Access Control
Inadvertent Data Exposure/Loss
Inappropriate Use of Clear Text
Lack of Adequate Physical Security
Natural Disaster
Loss of Network Connectivity; Man-
made Disaster, Construction,
Contamination
Hardware Failure/Service Loss
Malware
Social Engineering, Phishing
Insecure Vendor or Custom-Developed
Software
Lack of Service Level Agreement
External Vendors
IP Spoofing or Forgery
Lack of Funds
Outdated Continuity of Operations Plan
(COOP)
* See ‘Understanding Likelihood and Impact Ratings & Risk Responses’ -
http://www.it.vt.edu/ctssr/risk_assessment/it_risk.php for expanded definitions.
Table E: Mitigation strategies for each risk associated with a mission critical asset.
Mission Potential Risk Justificatio Current or planned controls or
Critical High Response* n for Risk actions to address risk
Asset Impact (Options: Response
Risks Accept, Avoid, Required
Mitigate,
Share,
Transfer)
Example:
Asset C Risk 1 accept Compensati Control X is implemented – no
ng controls action required.
in place.
Risk 2 Example:
accept No funding No action required
to
implement
compensati
ng controls
Example: Plans Plans underway to implement
Risk 3 mitigate underway control X Enforce control X
to
implement
control X
Example:
share Shared We monitor access control lists,
responsibilit manage data integrity etc.
y with
hosting.
Example:
transfer Compliance Transferred responsibility of
requirement protecting data to third party
university contracted provider.
Example:
Risk 3 Avoid Unnecessar Eliminate the process that poses
y process, high risk.
Risk 1
Asset A Solution 1
Risk 2 Solution 1
Solution 2
*Risk Response is the stated decision of accepting, avoiding, mitigating, sharing, or transferring an
identified risk to organizational operations. See ‘Understanding Likelihood and Impact Ratings & Risk
Responses’ for expanded definitions.
Note: Please copy and paste the headings below as many times as needed to provide status details
for each previously noted risk
Critical Asset(s):
Risk(s) identified:
Proposed Solution(s):
Asset C,
Risk 1,
Proposed Solution 1:
Cost – if known:
Expected Benefits:
Person(s) responsible for monitoring and/or executing the solution:
Proposed Timetable for implementing solution:
Asset C,
Risk 1,
Solution 2:
Cost – if known:
Expected Benefits:
Person(s) responsible for monitoring and/or executing the solution:
Proposed Timetable for implementing solution: