This guide describes how to manage risk, how it fits into each section of the SDLC, and how the risk management process is tied to the authorization (or authorization) process. Risk management involves three processes: risk assessment, risk reduction, and monitoring and evaluation. This guide outlines primarily risk reduction, which focuses on prioritizing, implementing, and maintaining appropriate risk mitigation measures recommended in the risk assessment process. The DAA or authorizing officer is responsible for determining whether the remaining risk is at an acceptable level or whether additional security controls should be used to further reduce or eliminate the remaining risk before authorizing (or authorizing) the IT system to operate.
Risk management is a process that allows IT managers to estimate the operational and economic costs of security measures and to reap the benefits of equipment efficiency by protecting IT systems and data that supports the activities of their organizations. This process is not limited to the IT environment; indeed, it is full of decisions in all aspects of our daily lives. Take, for example, the matter of home security. Many people decide to install security systems at home and pay a monthly fee to the service provider so that these systems can be monitored to better protect their property. Possibly, homeowners estimate the cost of installing and monitoring the system by comparing the value of their furniture with the safety of their families, the basic “work” requirement.
The head of the organization must ensure that the organization has the necessary skills to fulfil its mission. These equipment owners must determine the security capabilities their IT systems must have to provide the required level of equipment support when faced with real-world threats. Many organizations have a strong IT security budget; therefore, the use of IT security should be as well reviewed as other management decisions. A well-designed risk management system, if used effectively, can help managers identify appropriate controls to provide critical safety skills.
Integration of Risk Management into SDLC
Reducing the negative impact on the organization and the need for a sound foundation in decision-making are important reasons organizations are implementing a risk management process in their IT systems. Effective risk management should be fully integrated into the SDLC. The SDLC for IT system has five stages: implementation, development or acquisition, implementation, implementation or maintenance, and disposal. In some cases, the IT system may take several of these stages at once. However, the risk management approach is the same regardless of which SDLC class is being tested. Risk management is a repetitive process that can be performed during each major phase of the SDLC. The table below describes the features of each phase of the SDLC and shows how risk management can be implemented to support each phase:
- Phase 1 — Introduction – The need for an IT system is identified and the purpose and scope of the IT plan is documented – Identified risks are used to support the development of system needs, including security needs, and operational safety (strategy) concept.
- Phase 2 — Development or Acquisition – The IT system is designed, purchased, planned, upgraded, or otherwise constructed – Risks identified in this section may be used to support an IT system security analysis that may lead to commercial real estate and design offs during system development.
- Phase 3 — Implementation – System security features must be activated, enabled, tested, and verified – Risk management system supports system implementation testing against its own requirements and within its model operating environment. Decisions regarding identified risks should be made prior to the implementation of the plan.
- Phase 4 — Performance or Care – The program performs its functions. Usually, the system is continuously updated with the addition of hardware and software and changes in organizational processes, policies, and procedures – Risk management functions are performed to periodically re-authorize the system (or re-authorize) whenever major IT system changes in its function, in the production environment (e.g. links to the new system).
- Section 5 — Disposal – This section may include information loss, hardware, and software. Tasks may include disassembling, archiving, disposing, or destroying information and cleaning hardware and software – Risk management functions are performed on system components that will be discarded or replaced to ensure that hardware and software are disposed of properly, that residual data is handled properly, and that system migration is done in a secure and orderly manner.
Risk Management – Key Roles
Risk management is a management responsibility. This section describes the key roles that staff members must support and participate in the risk management process.
- Senior Management. Senior management, under the appropriate level of care and the ultimate responsibility for the completion of equipment, must ensure that the necessary resources are used effectively to develop the skills required to carry out the work. They should also assess and integrate the results of the risk assessment activity into the decision-making process. An effective risk management system that monitors and mitigates the risks of IT-related equipment requires the support and involvement of senior management.
- Chief Information Officer (CIO). The CIO is responsible for the institution’s IT planning, budget, and operations including its information security components. Decisions made in these areas should be based on an effective risk management plan.
- System Owners and Information. Systems and information owners have a responsibility to ensure that there is proper controls to address the integrity, confidentiality, and accessibility of IT systems and data. Generally, system owners and knowledge holders are responsible for changes in their IT systems. Thus, they often have to approve and sign changes to their IT systems (e.g., system upgrades, major software and hardware changes). System owners and information owners must therefore understand their role in the risk management system and fully support this process.
- Business and Personnel Managers. Managers responsible for business operations and IT procurement processes must play an active role in the risk management system. These managers are the people with the authority and responsibility to make the most important trade decisions to achieve the goal. Their involvement in the risk management system enables the effective protection of IT systems, which, if managed properly, provide efficient equipment operation at minimal cost of resources.
- ISSO. IT security managers and computer security officials are responsible for the security systems of their organizations, including risk management. Therefore, they play a key role in introducing an effective, systematic approach to helping identify, evaluate, and reduce risk in IT systems that support the work of their organizations. ISSOs also serve as key facilitators in supporting senior management to ensure that this work is carried out continuously.
- IT security personnel. IT security personnel (e.g., network, system, application, and site administrators; computer experts; security analysts; security coordinators) are responsible for the proper use of security requirements in their IT systems. As changes occur in an existing IT system environment (e.g., increased network connectivity, changes in existing infrastructure and organizational policies, introduction of new technologies), IT security staff must support or implement a risk management process to identify and evaluate new capabilities. risk and use of new security controls as needed to protect their IT systems.
- Safety Awareness Trainers (Security Specialists / Topic). Organizational staff are users of IT systems. The use of IT systems and data in accordance with organizational policies, guidelines, and codes of conduct are essential to reducing risk and protecting the organization’s IT resources. To reduce the risk to IT systems, it is important that system users and applications are provided with security awareness training. Therefore, IT security trainers or security / topic specialists must understand the risk management process to develop appropriate training materials and integrate risk assessments into training programs to educate end users.
Risk Management Practise
The risk assessment process is usually repeated at least every 3 years in government positions, as mandated by the OMB Circular A-130. However, risk management should be developed and integrated into the SDLC for IT systems, not because it is required by law or regulation, but because it is a good practice and supports the business objectives of the organization or policy. There should be a specific schedule for testing and mitigation of equipment, but the process from time to time should also be flexible enough to allow for changes where appropriate, such as major changes in the IT system and processing area due to changes caused by new policies and technologies.
An effective risk management plan will depend on (1) the commitment of senior management; (2) full support and participation of the IT team; (3) the capacity of the risk assessment team, which must have the ability to implement a specific risk assessment approach and plan, identify policy risks, and provide affordable protections that meet the needs of the organization; (4) the awareness and co-operation of members of the user community, who must follow procedures and comply with applicable regulations to protect their organization’s mission; and (5) further evaluation and risk assessment of IT-related equipment.
Protecting your business from the ever-present dangers of cybercrime may seem like an impossible task, especially if your organization needs more attention. Fortunately, it is now easier to maintain the security of your application and to manage your potential risks with Kanoo Elite professional solutions and services, which provide the most secure solutions with risk management features. Kanoo Elite provides you with a high level of security and risk management strategies, allowing you to focus on your business, helping you protect your organization no matter what risk options you choose.
