Risk criteria
Define impact, likelihood, scoring, risk acceptance, escalation, and treatment expectations.
Focused Service
Information Security Risk Assessment
Establish a defensible view of information security risk and translate it into prioritized treatment decisions.
When to Engage
Use this service when a defined decision, assurance need, or capability gap requires focused support.
- Leadership needs a current and consistent risk baseline.
- Audit, customer, board, or regulatory expectations require documented risk decisions.
- Technology, supplier, cloud, or business changes have altered the organization’s exposure.
Service Scope
Structured work from current-state understanding to decision-ready outputs.
Exact scope, evidence, access, stakeholders, and acceptance criteria are agreed before delivery.
Context and asset mapping
Identify critical processes, information, systems, suppliers, owners, dependencies, and existing controls.
Risk analysis
Document credible threats, vulnerabilities, control conditions, impacts, likelihood, and residual risk.
Treatment planning
Prioritize risk treatment, owners, target dates, dependencies, acceptance decisions, and reporting.
Typical Deliverables
Artifacts designed for ownership, evidence, and sustained use.
- Risk criteria and assessment method
- Asset, process, and dependency inputs
- Information security risk register
- Risk treatment priorities and action plan
- Executive risk summary and heat map
- Residual-risk and acceptance record
Delivery Approach
Proportionate delivery with clear stages and decision points.
Discover & Scope
Confirm the business driver, environment, stakeholders, boundaries, assumptions, and evidence needs.
Assess & Analyze
Review the current state, evidence, architecture, risks, dependencies, and material gaps.
Design & Deliver
Develop the agreed controls, artifacts, recommendations, implementation, or operating routines.
Validate & Improve
Confirm completion, residual risk, ownership, reporting, and the next improvement priorities.
Connected Services
Extend the work without duplicating discovery or evidence.
Governance, Risk & Compliance
Explore serviceThird-Party Risk Management
Explore serviceISO 27001 Readiness
Explore service