One component that is already being continuously emphasized in an increasing number of regulations, like PCI DSS, HIPAA, GLBA, FISMA, SOX, etc., is Risk Assessment. In the past few years, hackers around the world have proven that Information Systems are under serious and persistent threat, and organizations will have to take strict measures to ensure the security of their Information Systems. With increasing use of ‘BYOD’ and the exploding IoT (Internet of Things), the risk associated with technology continues to rise. Therefore, it becomes the responsibility of leaders and managers at all levels to understand their current standing, exposure and information security risk.

The need for a Risk Assessment approach that is effective, efficient and robust is clear, but a ‘One Size Fits All’ strategy cannot be applied to Risk Assessments due to the varying nature of Information Systems deployed in different organizations. Despite many Risk Assessment technologies and frameworks available, organizations still face many challenges to conduct an effective Risk Assessment. Additionally, these challenges pave the way for opportunities waiting to be explored and infuse improvements to the process.

In the coming weeks, we will discuss such challenges and opportunities presented within Risk Assessment.