Increasing the Frequency of Risk Assessments
Time to ramp up your risk assessment!
When it comes to IT risk assessment, frequency is just as important as the actual assessment. While HIPAA and other compliance mandates only require annual assessments, some experts say this is not enough for most organizations.
Director of risk and advisory services for Neohapsis, Gary Alterson, suggests moving to at least a quarterly assessment schedule. “Given the rapidly changing threat environment and how fast IT moves, I recommend that risk assessments be refreshed and reviewed at least quarterly, if not monthly,”
In order to be able to keep up with the increase in assessments, organizations need to rethink their approach to the process.
“A better approach is to make risk assessments more of a life cycle and process within the organization. Perform assessments continuously throughout the year,” says Jim Mapes, chief security officer at BestIT.
Organizations need to build time and resources into the IT lifecycle. Here are some tips to starting:
- Track. Start a daily tracking of risk factors.
- Prioritize. Focus on what matters most, the most risk-adverse data.
- Mitigate. Don’t just assess risk, work towards mitigating it throughout the IT lifecycle.
Original article by Ericka Chickowski.
Read the full story here.
Leave a comment
An honest sidebar. In the past year, we have received feedback from our regular webin Read more
Some of them about passwords . . . By view count, here are the top seven posters as o Read more
Experts warn that criminals may be trying to take advantage of the rush of shoppers… Read more
Recent revelations are a reminder of the risks associated with networked devices… An Read more