Methodology for evaluating usage and comparison of risk assessment and risk management items

ENISA ad hoc working group on risk assessment and risk management

Methodology for evaluating usage and comparison of risk assessment and risk management items

Deliverable 2 Version 1 Date: 26/04/2007 Deliverable 2

1 Concept and Purpose

The ENISA ad-hoc working group on risk assessment and management (referred to in this document as “the Working Group”) has determined a methodology to allow direct comparison between items that enable organizations to perform risk assessment and risk management. The methodology considers the processes of risk assessment and management items, together with the inputs and outputs to these, and scores these against a benchmark set of processes, inputs and outputs, as determined by the Working Group. The purpose of the methodology is to allow one or both of the following to be performed: • Determination of the most appropriate risk assessment and management items for use by organizations in a range of given circumstances; such as their business sector, size, culture, legal, regulatory and governance requirements, as well as the sophistication of their risk management approach and the resources available to them. • Direct comparison between two or more risk assessment or management items in order to permit expert advice to be given on their suitability for use in particular circumstances.

2 Terms

The following terms are used in this document. Term Definition Benchmark A set of possible risk assessment and management processes (qv), inputs (qv) and outputs (qv) defined by the ENISA ad-hoc working group on risk assessment and management and used as a reference in this paper. Characterisation Methodology for defining any item (qv) in relation to the Benchmark (qv) Alignment Scoring the processes (qv), inputs (qv) and outputs (qv) of an item (qv) in relation to the Benchmark (qv) Alignment Radar chart showing the results of scoring the processes (qv), inputs (qv) and profile outputs (qv) of an item in relation to the Benchmark (qv) Input Information and data required by a process (qv) in order to allow it to function as intended Item A tool, code of (good) practice or methodology in use for risk assessment or risk management or both. Output Result produced by a process (qv) that enables an item (qv) to deliver useful functionality. Process Operation performed on input (qv) by an item (qv) in order to produce an appropriate output (qv)

ENISA ad hoc working group on risk assessment and risk management 3 / 61

Deliverable 2 Term Definition Use case A set of defined circumstances under which an item (qv) might be used; determined by the user’s business sector, size, culture, legal, regulatory and governance requirements, sophistication of its risk management approach, available resources and other factors.

3 Benchmark processes, inputs and outputs

The Working Group has defined a benchmark set of the possible processes, inputs and outputs that organizations might expect to see incorporated into items used in the assessment and management of information risk; these are referred to in the rest of this paper as “the Benchmark”. The Benchmark has been compiled from the range of items studied by the Working Group, and is based on both the experience of Working Group members and on the process described on the ENISA website (www.enisa.europa.eu/rmra/rm_process.html). The Benchmark is shown in Annex A of this document. The Benchmark divides risk assessment and management into the following five stages and 15 processes: • Stage A: Definition of scope and framework: o P.1 Definition of external environment o P.2 Definition of internal environment o P.3 Generation of risk management context o P.4 Formulation of impact limit criteria • Stage B: Risk assessment: o P.5 Identification of risks o P.6 Analysis of relevant risks o P.7 Evaluation of risks • Stage C: Risk treatment: o P.8 Identification of options o P.9 Development of action plan o P.10 Approval of action plan o P.11 Implementation of action plan o P.12 Identification of residual risks • Stage D: Risk acceptance o P.13 Risk acceptance • Stage E: Risk monitoring and review o P.14 Risk monitoring and reporting • Stage F: Risk communication, awareness and consulting o P.15 Risk communication, awareness and consulting

ENISA ad hoc working group on risk assessment and risk management 4 / 61

Deliverable 2 It is possible to “characterise” an item in relation to the Benchmark by comparing an item’s processes, inputs and outputs with their equivalents as described in the Benchmark at Annex A. This is done using the methodology explained in section 4 below. Characterisation of items enables an organization to perform one or more of the following functions: 1. Determine the suitability of a characterised item as it relates the overall requirements of the organization, by referring to the “use cases” discussed in section 5. 2. Characterise a particular item to determine if is suitable for use in specific circumstances, as discussed in section 6. 3. Objectively compare two or more characterised items in order to see their relative strengths and weaknesses, as discussed in section 7.

4 Characterisation methodology

Characterisation of an item is undertaken by comparing a description of the item with the descriptions given in the Benchmark at Annex A. An item is characterised by evaluating it in relation to the Benchmark. The evaluation is made by assigning a score to the item’s processes, and to the inputs and outputs of those processes, according to the degree of convergence these have to their equivalents in the Benchmark. The scores for processes should be determined using table 1. Score Convergence of item process with equivalent Benchmark process 0 Process not mentioned at all 1 Process described as part of the item with an external process referenced 2 Process described in some detail with simple instructions 3 Process very highly detailed and exhaustive Table 1: Scoring for processes If an item’s processes are considered to occupy a position that is intermediate between the descriptions above, an intermediate score (such as 1.5) may be given. The scores for inputs and outputs to and from processes should be determined using table 2. Score Convergence of item’s input/output with equivalent Benchmark input/output 0 Input/output not mentioned at all 1 Input/output described with reference to an external process 2 Input/output described in some detail with simple instructions 3 Input/output described in great detail with exhaustive instructions Table 2: Scoring for inputs to, and outputs from processes Again, if the inputs or outputs are considered to occupy a position that is intermediate between the descriptions above, an intermediate score (such as 1.5) may be given. It will be seen that an item can be characterised on the basis of an evaluation of its processes, or of its inputs or its outputs. For broad comparison purposes, characterisation on the basis of ENISA ad hoc working group on risk assessment and risk management 5 / 61 Deliverable 2 processes will be sufficient. This will enable an “alignment profile” to be drawn on the basis of the scores for each of the 15 processes. On the other hand, characterising an item on the basis of an evaluation of the inputs to, or outputs from, its processes, will give a more granular result. In this case an alignment profile should be produced for individual processes. Once an item has been evaluated according to the scoring systems described above, an alignment profile can be produced, by plotting the scores for each process on a radar chart. Examples of such alignment profiles for processes in the IT-Grundschutz methodology from the German BSI are given in figures 1 to 3. Please note that these figures are derived from Annex B, which shows the entire IT-Grundschutz methodology compared with the Benchmark. An alignment profile for the processes of the entire IT-Grundschutz methodology is given in figure 1. Figure 2 shows the alignment profile for inputs to process P.5 (identification of risks) for IT- Grundschutz and figure 3 for the IT-Grundschutz outputs from the same process. It will be recognised that the two alignment profiles are different, indicating that the process has some variations in its requirements for input and in the degree of output that it produces. This variability could be of significance when selecting an item for a particular use (see sections 6 and 7 below). It will be noted that the axes of the chart have been scaled to start at -1, this is to avoid the problem of ‘blank’ cells should a process have a zero score. Figure 1: Alignment profile generated by IT-Grundschutz processes

ENISA ad hoc working group on risk assessment and risk management 6 / 61

Deliverable 2 Figure 2: Alignment profile generated by IT-Grundschutz inputs to process P.5 Figure 3: Alignment profile generated by IT-Grundschutz outputs from process P.5

ENISA ad hoc working group on risk assessment and risk management 7 / 61

Deliverable 2

5 Determining overall organizational requirements

Organizations may wish to determine their overall requirement for a risk assessment and management methodology by considering a number of “use cases”. An organization wishing to do this should look at the examples given in table 3 below. The Working Group has identified five use cases. These are listed in table 3, together with examples of the type of organization that might be typical of each use case and a brief description of the risk assessment and management (RA/RM) requirements that might be appropriate to each type of organization. Nr Type Example RA/RM Requirements 1 Small business, where Small shop, small Understand critical business Internet usage is not part of professional consultancy assets, threats and the business processes. No businesses (including law, vulnerabilities. dedicated IT-resources. architecture etc.) Plan and implement appropriate countermeasures 2 Small to medium-sized Small e-commerce Understand critical business business with more businesses, small media assets, threats and extensive Internet usage, businesses vulnerabilities and conduct a where Internet is core to the risk analysis. business process Plan and implement appropriate countermeasures. Identification of residual risks. Risk monitoring and reporting 3 Medium-sized private Private trucking, logistic, Understand critical business business with simple manufacturing and assets, threats and governance requirements publishing companies. vulnerabilities and conduct a risk analysis. Develop and implement action plan. Define procedures for risk acceptance, monitoring and internal communication of these. 4 Medium to large-sized Food companies, insurance, Define the scope of their business with more complex companies, all those types of internal and external governance requirements organization in 3 that are requirements. also public companies. Apply well-defined processes and procedures for risk assessment, risk management and monitoring and internal and external communication of these.

ENISA ad hoc working group on risk assessment and risk management 8 / 61

Deliverable 2 Nr Type Example RA/RM Requirements 5 Large-sized business with Pharmaceutical, chemical, Define the scope of their rigorous governance energy, telecommunications, internal and external requirements utilities and banking. requirements. Apply welldefined and clearly communicated processes and procedures for risk assessment and risk management as well as detailed monitoring, auditing and communication processes for both internal and external use. Table 3: Use cases for risk assessment and risk management The Working Group has evaluated scores for the processes that would be appropriate to each of the five use cases described above. These scores have been used to produce a series of alignment profiles for processes that are illustrated in the radar diagrams in sections 5.1 to 5.5 below. These alignment profiles are illustrative only. It is intended that users compare the alignment profile that is most appropriate to their circumstances to those of a range of items (for example see section 7). This will enable them to make a preliminary selection of the item, or items, that might be most appropriate to their circumstances. However, organizations are expected to refine this process by producing their own individual alignment profile. Using this, a more accurate selection of items can be made. 5.1 Small business with limited Internet usage Figure 4 shows a process alignment profile for this use case. The requirements of a small business are based on the following assumptions: • The external IT risk is low, because the Internet is not core to the business, and can be simply managed using “off-the-shelf” technology and the internal environment is simple due to the small size of the business. The risk management context and impact limit criteria are therefore obvious to the management, and do not require extensive analysis. • Identification and analysis of risks, however, may be more complex as a result of limited understanding of the IT systems in use. • Evaluation of risks, identification of options, definition of action plan and approval are easily and simply achieved by the small number of individuals involved. Although implementation of an action plan requires that some procedures need to be defined and implemented. • Identification of residual risks and risk acceptance can be carried out easily and simply by the small number of individuals involved. • Risk communication, awareness and consulting can be implemented intuitively, well defined processes are not therefore required.

ENISA ad hoc working group on risk assessment and risk management 9 / 61

Deliverable 2 Figure 4: Alignment profile for use case 1: Small business with simple Internet usage 5.2 Small to medium-sized business with more extensive Internet usage Figure 5 shows a process alignment profile for this use case. The requirements of a small to medium-sized enterprise, in which the Internet is business-critical, are based on the following assumptions: • The external IT risk is higher, because the Internet is business-critical and the internal IT risk is higher, because IT systems are business-critical. The risk management context must therefore be more carefully analysed and the impact limit criteria must be more precisely determined in relation to the business. • Identification and analysis of risks will also be more complex because of the business’s dependency on IT systems, which may be more complex than can be easily managed. • Evaluation of risks and identification of options are not evident and need defined, reliable processes and procedures. • Because of its complexity, the action plan should be developed by specialists, with formal approval by management. • Implementation of action plan requires the use of defined, reliable processes and procedures. • Identification of residual risks must be carried out carefully, to safeguard business-critical systems. • Risk acceptance processes and procedures are simple because of the small size of the organization. • Risk monitoring and reporting must be reliable, but need not be complex because of the small size of the organization.

ENISA ad hoc working group on risk assessment and risk management 10 / 61

Deliverable 2 • Communication, awareness and consulting will also be relatively simple because of the small size of the organization. Figure 5: Alignment profile for use case 2: Small to medium-sized business with more complex Internet usage 5.3 Medium-sized private business with simple governance requirements Figure 6 shows a process alignment profile for this use case. The requirements of a medium-sized private business with simple governance requirements are based on the following assumptions: • The external and internal IT risk is somewhat higher as a result of the business size and complexity. This accordingly demands more complex analysis of the risk management context and defined processes and procedures to determine the impact limit criteria and provide comparability. • The size and complexity of the business will also require more complex identification, analysis and evaluation of risks, together with clearly defined, reliable processes and procedures. • The size and greater complexity of the organization may also require specialist input into the development of the action plan, as well as clearly defined approval procedures for it. • Implementation of action plan will require a clearly defined roll-out and associated control procedures • The size and greater complexity of the organization also require more careful identification of residual risks and a clearly defined process for risk acceptance. • As a result of the size and greater complexity of the organization, risk monitoring and reporting processes and procedures will be needed, as will improved risk communication, awareness and consulting.

ENISA ad hoc working group on risk assessment and risk management 11 / 61

Deliverable 2 Figure 6: Alignment profile for use case 3: Medium-sized business with simple governance requirements 5.4 Medium to large-sized business with more complex governance requirements Figure 7 shows a process alignment profile for this use case. The requirements of a medium-tolarge-sized, publicly-quoted company are based on the following assumptions: • External and internal IT risks are highly complex, requiring precise analysis of the risk management context and well-defined impact limit criteria. • Identification and analysis of risks are complex and have to be carried out carefully. • Evaluation of risks and identification of options are also complex, requiring well defined processes and procedures. • The action plan must be developed by specialists and will require well-defined and clearly set-out approval procedures, which must be auditable. • Implementation of action plan requires the definition of clearly defined roll-out and control procedures. • The identification of residual risks must be subject to well defined, auditable procedures and decisions on risk acceptance must follow traceable, reproducible and auditable processes and procedures. • Processes and procedures for risk monitoring and reporting must be well defined and auditable. • Processes for risk communication, awareness and consulting must be clear, well implemented and auditable.

ENISA ad hoc working group on risk assessment and risk management 12 / 61

Deliverable 2 Figure 7: Alignment profile for use case 4: Medium to large-sized business with more complex governance requirements 5.5 Large-sized business with rigorous governance requirements Figure 8 shows a process alignment profile for this use case. The requirements of a large-sized business with rigorous governance requirements are based on the assumption that the size, complexity and audit requirements of such organizations will require that the utmost attention should be paid to all aspects of risk assessment and management. It is therefore assumed that such an organization will have detailed and complex requirements for processes in all three stages.

ENISA ad hoc working group on risk assessment and risk management 13 / 61

Deliverable 2 Figure 8: Alignment profile for use case 5: Large-sized business

ENISA ad hoc working group on risk assessment and risk management 14 / 61

Deliverable 2

6 Identification of an item for specific use

An alignment profile can be drawn for any item. This can then be used to determine if an item is most suitable for a use case relevant to a particular organization. Or to an organization’s own required alignment profile, which might (for example) be determined by its individual ability to provide inputs and/or outputs to an RA/RM methodology. As examples: figure 9 shows the alignment profile for the processes of NIST SP 800-30; figure 10 shows the alignment profile for the processes of Dutch A&K Analysis and; figure 11 shows the alignment profile for the processes of ISO/IEC 17799:2005. Annex B contains tables showing the full comparison between the NIST, Dutch A&K and ISO 17799 methodologies and the Benchmark. A description of these items, and IT-Grundschutz (whose alignment profiles are shown in figures 1 to 3), can be found at the ENISA website under: http://www.enisa.europa.eu/rmra/rm_ra_methods.html. Organizations may also wish to select particular processes from different items in order to perform specific functions. For example, although a smaller organization may feel it appropriate to use the NIST methodology overall, it may decide that its circumstances require a more detailed analysis of its risk identification (P.5). In which case it would look at the alignment profiles for the inputs and outputs to that particular process for a number of other items. An example of a comparison of inputs and outputs to a particular process is discussed in the next section (see figures 12 and 13). Figure 9: Alignment profile of NIST SP 800-30 processes

ENISA ad hoc working group on risk assessment and risk management 15 / 61

Deliverable 2 Figure 10: Alignment profile of Dutch A&K Analysis processes Figure 11: Alignment profile of ISO/IEC 17799:2005 processes

ENISA ad hoc working group on risk assessment and risk management 16 / 61

Deliverable 2

7 Direct Comparison between items

Alignment profiles for two or more items can also be used to compare the relative coverage of those items. At figure 12 is a comparison between the alignment profiles of IT-Grundschutz processes and NIST SP 800-30 processes. Figure 12: Comparison of alignment profiles of IT-Grundschutz and NIST processes Figure 12 clearly shows that the coverage of the IT-Grundschutz methodology is far broader and deeper than that of NIST, and should therefore be considered for use by large organizations, as comparison with figures 7 and 8 would indicate. However, it also shows that the NIST methodology would probably be better suited to deployment by small- or medium-sized businesses, as comparison with figures 4 and 5 will indicate. More granular comparison between items can take place at the level of inputs to, and outputs from, processes. Figure 13 compares the inputs to P.5 for IT-Grundschutz and NIST and Figure 14 shows the comparison for the outputs of P.5 for the same two methodologies.

ENISA ad hoc working group on risk assessment and risk management 17 / 61

Deliverable 2 Figure 13: Comparison of alignment profiles of inputs to P.5 for IT-Grundschutz and NIST Figure 14: Comparison of alignment profiles of outputs from P.5 for IT-Grundschutz and NIST

ENISA ad hoc working group on risk assessment and risk management 18 / 61

Deliverable 2 Organizations will be able to use comparisons, such as those illustrated in figures 13 and 14, to help determine which process from which items are likely to best meet their requirements, as discussed in section 6. In this example, for instance, it is clear that an organization which wished to justify why it had disregarded certain threats and vulnerabilities would have to use IT- Grundschutz for process P.5, in preference to NIST.

ENISA ad hoc working group on risk assessment and risk management 19 / 61

Deliverable 2

References

[BSI1] BSI Standard 100-1: "Information Security Management Systems", Bundesamt für Sicherheit in der Informationstechnik,version 1.0, December 2005, http://www.bsi.bund.de/english/publications/bsi_standards [BSI2] BSI Standard 100-2: "IT-Grundschutz Methodology", Bundesamt für Sicherheit in der Informationstechnik, version 1.0, December 2005, http://www.bsi.bund.de/english/publications/bsi_standards [BSI3] BSI-Standard 100-3: "Risk Analysis based on IT-Grundschutz ", Bundesamt für Sicherheit in der Informationstechnik, version 2.0, December 2005, http://www.bsi.bund.de/english/publications/bsi_standards [DAK] 'Handleiding Afhankelijkheids- en Kwetsbaarheidsanalyse: stappenplan voor de uitvoering van een A&K-analyse' (in Dutch), version 1.01, Ministry of Internal Affairs, The Hague, 1996, The Netherlands [ISO] ISO/IEC 17799:2005, Information technology- Security techniques – code of practice for information security management, version 2005, ISO, http://www.iso.ch [NIST] NIST Special Publication 800-30, "Risk Management Guide for Information Technology Systems", National Institute of Standards and Technology, July 2002, http://csrc.nist.gov/publications/nistpubs/

ENISA ad hoc working group on risk assessment and risk management 20 / 61

Deliverable 2

Annex A - Benchmark for risk assessment and management processes, inputs and outputs

Stage Process Input Output

A. Definition of P.1 Definition of I.1.1 Market information (market O.1.1 All records of the external scope and external indicators, competitive environment of the organization framework environment information, etc.) O.1.2 List of relevant obligatory I.1.2 Financial & political laws and regulations (with information respect to obligations) I.1.3 Relevant legal and O.1.3 Various lists with regulatory information applicable rules (social, cultural, values etc.) I.1.4 Information about geographical, social and cultural conditions I.1.5 Information about external stakeholders (values and perception) (Note: partners, competitors, other dependencies) P.2 Definition of I.2.1 Strategy on the O.2.1 Description of internal internal organization (goals, roles (and responsibilities) environment objectives, strengths, O.2.2 Description of the main weaknesses, opportunities business processes and threats, culture, O.2.3 Description of internal structure) assets (e.g. computing I.2.2 Description of internal center, cooling system, stakeholders heating system, network, I.2.3 Assets in terms of resources etc.) (people, systems, O.2.4 Description of processes, capital, etc.) relationships between O.2.2 and O.2.3 O.2.5. List of strategies (including IT-Strategy and IT-security strategy, if existing) O.2.6 Risk appetite or tolerance (risk orientation of the organization)

ENISA ad hoc working group on risk assessment and risk management 21 / 61

Deliverable 2

Stage Process Input Output

P.3 Generation of I.3.1 O.2.3 O.3.1 Detailed risk management I.3.2 Target object scope assessment/management context I.3.3 Scope of the assessment/ plan including: management activities O.3.2 List of assigned (inclusion/exclusion of participants to roles in the parts) assessment/ management I.3.4 Definition of roles involved activities in the O.3.3 List of other activities and assessment/management actions to be taken under activity consideration (e.g. I.3.5 Dependencies with other cooperation, interfacing activities and, processes etc.) O.3.4 Definition of the organization and process to be assessed P.4 Formulation of I.4.1 Rules for impact O.4.1 List with criteria for the impact limit acceptance including forthcoming assessment criteria frequency, severity and activities value of assets affected O.4.2 Classification scheme for I.4.2 Asset classification assets reflecting the importance/value of assets to the business B. Risk P.5 Identification I.5.1 Determined methodology O.5.1 List of relevant threats assessment of risks to be used for the O.5.2 List of relevant identification of risk (i.e. vulnerabilities of (groups threats, vulnerabilities and of) assets impacts) O.5.3 List of relevant impacts I.5.2 Threats, vulnerabilities and O.5.4 List of values including impact statements that will frequency, severity and be used in the assessment value of assets affected I.5.3 Historical information that O.5.5 Documentation of the can be used to assess the identification method likelihood of impact O.5.6 Likelihood data (e.g. I.5.4 Checklists and tools for the history database) assessment O.5.7 Justification for threats and vulnerabilities intentionally disregarded

ENISA ad hoc working group on risk assessment and risk management 22 / 61

Deliverable 2

Stage Process Input Output

P.6 Analysis of I.6.1 All outputs from 5 above O.6.1 Tables with assets relevant risks I.6.2 Lists with relevant detailed classified according to the assets (drawn from O.2.4) classification scheme I.6.3 O.5.1 with information O.6.2 List of threats and about risk limits and O.4.2 vulnerabilities relative to I.6.4 List of existing controls each asset (technical / organizational) O.6.3 List of existing controls relative to each asset (part of so-called gap analysis) O.6.4 List of impacts relative to each asset O.6.5 List of risks relative to each asset O.6.6 (According to the analysis method) Qualified or quantified risks relative to each asset or asset group (with consequences, likelihood, cumulative impact relative to each asset or asset group) P.7 Evaluation of I.7.1 All outputs of 6 above O.7.1 Formal decision by risks I.7.2 All outputs of 4 Management about previously analyzed risks and about which risks will be treated (and possibly with what priority) or left untreated C. Risk P.8 Identification I.8.1 O.4.1 including the relevant O.8.1 Risk treatment options treatment of options limits for the risks according to risks (possibly I.8.2 O.7.1 classified according to the I.8.3 List of options for risk risk limits) treatment P.9 Development I.9.1 O.8.1 O.9.1 Action plan as sequence of of action plan I.9.2 Assigned organizational prioritized activities roles (e.g. from O.3.2) (expressed as I.9.3 Possible planning implementation of controls methodology or as protection of assets) I.9.4 Possible priority scheme to O.9.2 Assignment of resources be used (e.g. costs) for action plan implementation O.9.3 Assignment of responsibilities for each action P.10 Approval of I.10.1 O.9.1 O.10.1 Approved lists with action plan I.10.2 Reports and presentation activities techniques for findings of I.10.1

ENISA ad hoc working group on risk assessment and risk management 23 / 61

Deliverable 2

Stage Process Input Output

P.11 I.11.1 O.9.1 O.11.1 Coordination of activities Implementation of I.11.2 O.3.3 O.11.2 Progress reports from action plan I.11.3 Reporting scheme from other projects within other activities O.11.3 Progress reports from the I.11.4 Reporting on costs for implementation of implementation measurements (e.g. from ISMS) O.11.4 Overview of costs P.12 Identification I.12.1 O.14.1 O.12.1 Triggering of activities 6 of residual risks and 7 O.12.2 Evaluated residual risks D. Risk P.13 Risk I.13.1 O.12.2 O.13.1 Formal decision by acceptance acceptance I.13.2 O.7.1 management on the way risks have been treated E. Monitor and P.14 Risk I.14.1 External reference O.14.1 Reports on events and Review monitoring and documents e.g.: consequences to internal reporting - Metrics methodologies stakeholders - Incident data from O.14.2 Reports on events and CERTs consequences to external - Information from concerned parties (e.g. dedicated security state agencies and organizations (ENISA, stakeholders) ISACA, SANS, NIST, O.14.5 Internal indicators (e.g. etc.) KPIs) I.14.2 Internal reference O.14.6 Cost indicators documents: - O.7.1, O.13.1 - O.11.3 I.14.3 Lists of Security Policies I.14.4 O.9.1 I.14.5 Reports on incidents from business processes I.14.6 O.9.2 (concerning costs) F. Risk P.15 Risk I.15.1 Reporting on incidents O.15.1 Communication to communication communication, (external and internal) internal and external awareness and awareness and I.15.2 Requests to inform partners consulting consulting Management arising O.15.2 Awareness information from the risk treatment for all involved plan stakeholders I.15.3 Awareness information O.15.3 Consulting request to coming from relevant external specialists sources (e.g. internal O.15.4 Risk communication plan directives and rules for for the enterprise. processing and using information systems) I.15.4 Consulting reports from experts (internal and external) I.15.5 Requests for consulting on detailed security issues, or to perform an evaluation activity.

ENISA ad hoc working group on risk assessment and risk management 24 / 61

Deliverable 2

Annex B - Mapping the Benchmark to specific items

Mapping the Benchmark to ISO 17799:2005 ([ISO])

Stage Process Proc Benchmark Input Item Input Input Benchmark Output Item Output Output ess Score Score Scor e

A. Definition P.1 1 I.1.1 Market information Absent 0 O.1.1 All records of the Absent 0 of scope and Definition of (market indicators, external environment framework external competitive information, of the organization environment etc.) I.1.2 Financial & political Absent 0 O.1.2 List of relevant 15.1.1 Identification 1 information obligatory laws and of applicable regulations (with legislation respect to obligations) I.1.3 Relevant legal and 15.1 Compliance 1.5 O.1.3 Various lists with 15.1.1 Identification 1 regulatory information with legal applicable rules of applicable requirements (social, cultural, legislation values etc.) I.1.4 Information about 6.1.6 Contact with 1 geographical, social and authorities cultural conditions I.1.5 Information about 6.1.6 Contact with 1.5 external stakeholders authorities (values and perception) 6.1.7 Contact with (Note: partners, special interest competitors, other groups dependencies) 6.2.1 Identification of risks related

ENISA ad hoc working group on risk assessment and risk management 25 / 61

Deliverable 2

Stage Process Proc Benchmark Input Item Input Input Benchmark Output Item Output Output ess Score Score Scor e

to external parties P.2 1 I.2.1 Strategy on the 5.1.1 Information 1.5 O.2.1 Description of 8.1.1 Roles and 1,5 Definition of organization (goals, security policy internal roles (and responsibilitie internal objectives, strengths, document responsibilities) s environment weaknesses, opportunities 6.1.1 Management and threats, culture, commitment to structure) information security I.2.2 Description of internal 6.1.2 Information 1.5 O.2.2 Description of the Absent 0 stakeholders security co- main business ordination processes 6.1.3 Allocation of information security responsibilities I.2.3 Assets in terms of 7.1.1 Inventory of 1.5 O.2.3 Description of 9.2 Equipment 1,5 resources (people, assets internal assets (e.g. security systems, processes, computing centre, capital, etc.) cooling system, heating system, network, etc.) O.2.4 Description of 7.2 Information 1,5 relationships between classification O.2.2 and O.2.3 O.2.5. List of strategies 5.1.1 Information 1,5 (including IT- security policy Strategy and IT- document security strategy, if existing)

ENISA ad hoc working group on risk assessment and risk management 26 / 61

Deliverable 2

Stage Process Proc Benchmark Input Item Input Input Benchmark Output Item Output Output ess Score Score Scor e

O.2.6 Risk appetite or 4.1 Assessing 1 tolerance (risk security risks orientation of the organization) P.3 1.5 I.3.1 O.2.3 9.2 Equipment 1.5 O.3.1 Detailed 6.1.1 Management 1 Generation of security assessment/managem commitment risk ent plan including: to information management security context I.3.2 Target object scope 4.1 Assessing 1 O.3.2 List of assigned 6.1.3 Allocation of 1,5 security risks participants to roles information in the assessment/ security management responsibilitie activities s I.3.3 Scope of the assessment/ 5.1.1. Information 1 O.3.3 List of other 6.1.5 1,5 management activities security policy activities and actions Confidentialit (inclusion/exclusion of document to be taken under y agreements parts) consideration (e.g. 6.1.6 Contact with cooperation, authorities interfacing etc.) 6.1.7 Contact with special interest groups I.3.4 Definition of roles 6.1.3 Allocation of 1.5 O.3.4 Definition of the 5.1.1. Information 1 involved in the information organization and security policy assessment/management security process to be document activity responsibilities assessed I.3.5 Dependencies with other Absent 0 activities and, processes

ENISA ad hoc working group on risk assessment and risk management 27 / 61

Deliverable 2

Stage Process Proc Benchmark Input Item Input Input Benchmark Output Item Output Output ess Score Score Scor e

P.4 1 I.4.1 Rules for impact 4.2 Treating 1 O.4.1 List with criteria for Absent 0 Formulation acceptance including security risks the forthcoming of impact frequency, severity and assessment activities limit criteria value of assets affected I.4.2 Asset classification 7.2 Information 1.5 O.4.2 Classification 7.2.1 Classification 1,5 reflecting the classification scheme for assets guidelines importance/value of assets to the business B. Risk P.5 0.5 I.5.1 Determined methodology 4.1 Assessing 1 O.5.1 List of relevant Absent 0 assessment Identification to be used for the security risks threats of risks identification of risk (i.e. (reference to threats, vulnerabilities and ISO/IEC TR impacts) 13335-3) I.5.2 Threats, vulnerabilities Absent 0 O.5.2 List of relevant Absent 0 and impact statements that vulnerabilities of will be used in the (groups of) assets assessment I.5.3 Historical information that 5.1.2 Review of the 1 O.5.3 List of relevant Absent 0 can be used to assess the information impacts likelihood of impact security policy I.5.4 Checklists and tools for Absent 0 O.5.4 List of values Absent 0 the assessment including frequency, severity and value of assets affected O.5.5 Documentation of Absent 0 the identification method O.5.6 Likelihood data (e.g. Absent 0 history database) O.5.7 Justification for Absent 0

ENISA ad hoc working group on risk assessment and risk management 28 / 61

Deliverable 2

Stage Process Proc Benchmark Input Item Input Input Benchmark Output Item Output Output ess Score Score Scor e

threats and vulnerabilities intentionally disregarded P.6 Analysis 1 I.6.1 All outputs from 5 above Absent 0 O.6.1 Tables with assets 7.1.1 Inventory of 1 of relevant classified according assets risks to the classification scheme I.6.2 Lists with relevant 7.2 Information 1.5 O.6.2 List of threats and 7.1.1 Reference to 1 detailed assets (drawn classification vulnerabilities ISO/IEC TR from O.2.4) relative to each asset 13335-3 I.6.3 O.5.1 with information 4.1 Assessing 1 O.6.3 List of existing 7.1.1 Reference to 1 about risk limits and security risks controls relative to ISO/IEC TR O.4.2 (reference to each asset (part of so- 13335-3 ISO/IEC TR called gap analysis) 13335-3) 7.2 Information classification I.6.4 List of existing controls 4.2 Treating 1 O.6.4 List of impacts 7.1.1 Reference to 1 (technical / security risks relative to each asset ISO/IEC TR organizational) 13335-3 O.6.5 List of risks relative 7.1.1 Reference to 1 to each asset ISO/IEC TR 13335-3 O.6.6 (According to the 7.1.1 Reference to 1 analysis method) ISO/IEC TR Qualified or 13335-3 quantified risks

ENISA ad hoc working group on risk assessment and risk management 29 / 61

Deliverable 2

Stage Process Proc Benchmark Input Item Input Input Benchmark Output Item Output Output ess Score Score Scor e

relative to each asset or asset group (with consequences, likelihood, cumulative impact relative to each asset or asset group) P.7 1 I.7.1 All outputs of 6 above 7.1.1 Reference to 1 O.7.1 Formal decision by 6.1.1 Management 1 Evaluation of ISO/IEC TR Management about commitment risks 13335-3 previously analyzed to information risks and about which security risks will be treated (and possibly with what priority) or left untreated I.7.2 All outputs of 4 0.75 C. Risk P.8 1 I.8.1 O.4.1 including the 0 O.8.1 Risk treatment 4.2 Treating 1 treatment Identification relevant limits for the options according to security risks of options risks risks (possibly classified according to the risk limits) I.8.2 O.7.1 1 I.8.3 List of options for risk 4.2 Treating 1 treatment security risks P.9 2 I.9.1 O.8.1 1 O.9.1 Action plan as 4.2 Treating 1 Development sequence of security risks of action plan prioritized activities (expressed as

ENISA ad hoc working group on risk assessment and risk management 30 / 61

Deliverable 2

Stage Process Proc Benchmark Input Item Input Input Benchmark Output Item Output Output ess Score Score Scor e

implementation of controls or as protection of assets) I.9.2 Assigned organizational 6.1.3 Allocation of 1.5 O.9.2 Assignment of 4.2 Treating 1 roles (e.g. from O.3.2) information resources (e.g. costs) security risks security for action plan responsibilities implementation I.9.3 Possible planning 4.2 Treating 1 O.9.3 Assignment of 6.1.3 Allocation of 1 methodology security risks responsibilities for information each action security responsibilitie s I.9.4 Possible priority scheme 4.2 Treating 1 to be used security risks P.10 1 I.10.1 O.9.1 1 O.10.1 Approved lists with 6.1.3 Allocation of 1 Approval of activities information action plan security responsibilitie s I.10.2 Reports and presentation 6.1.2 Information 1 techniques for findings of security I.10.1 coordination P.11 2 I.11.1 O.9.1 1 O.11.1 Coordination of 6.1.2 Information 1 Implementati activities security on of action coordination plan I.11.2 O.3.3 1.5 O.11.2 Progress reports 5.1.2 Review of the 1 from other projects information security policy

ENISA ad hoc working group on risk assessment and risk management 31 / 61

Deliverable 2

Stage Process Proc Benchmark Input Item Input Input Benchmark Output Item Output Output ess Score Score Scor e

I.11.3 Reporting scheme from 6.1.2 Information 1 O.11.3 Progress reports 5.1.2 Review of the 1 within other activities security from the information coordination implementation of security policy measurements (e.g. from ISMS) I.11.4 Reporting on costs for 4.2 Treating 1 O.11.4 Overview of costs 4.2 Treating 1 implementation security risks security risks P.12 1 I.12.1 O.14.1 1 O.12.1 Triggering of 5.1.2 Review of the 1 Identification activities 6 and 7 information of residual security policy risks O.12.2 Evaluated residual Absent 0 risks D. Risk P.13 Risk 1 I.13.1 O.12.2 0 O.13.1 Formal decision by 5.1.2 Review of the 1,5 acceptance acceptance management on the information way risks have been security policy treated 6.1.1 Management commitment to information security I.13.2 O.7.1 1 E. Monitor P.14 Risk 1.5 I.14.1 External reference 6.1.7 Contact with 1 O.14.1 Reports on events 6.1.2 Information 1 and review monitoring documents e.g.: special interest and consequences to security and reporting - Metrics methodologies groups internal stakeholders coordination - Incident data from CERTs - Information from dedicated security organizations (ENISA, ISACA, SANS, NIST, etc.)

ENISA ad hoc working group on risk assessment and risk management 32 / 61

Deliverable 2

Stage Process Proc Benchmark Input Item Input Input Benchmark Output Item Output Output ess Score Score Scor e

I.14.2 Internal reference 1.17 O.14.2 Reports on events 6.1.6 Contact with 1,5 documents: and consequences to authorities - O.7.1, O.13.1 external concerned 6.1.7 Contact with - O.11.3 parties (e.g. state special interest agencies and groups stakeholders) 6.2 External parties I.14.3 Lists of Security Policies 5.1.1 Information 1 O.14.3 Internal indicators 5.1.2 Review of the 1 security policy (e.g. KPIs) information document security policy I.14.4 O.9.1 1 O.14.4 Cost indicators Absent 0 I.14.5 Reports on incidents 13.1.1 Reporting 1.5 from business processes information security events I.14.6 O.9.2 (concerning costs) 1 F. Risk P.15 Risk 2 I.15.1 Reporting on incidents 13.1 Reporting 2 O.15.1 Communication to 6.1.2 Information 2 communicati communicati (external and internal) information internal and external security on, awareness on, security events partners coordination and awareness and 6.2.2 Addressing consulting and weaknesses consulting security when dealing with customers 6.2.3 Addressing security in third party agreements I.15.2 Requests to inform 5.1.2 Review of the 1 O.15.2 Awareness 8.2.2 Information 1,5 Management arising from information information for all security the risk treatment plan security policy involved stakeholders awareness,

ENISA ad hoc working group on risk assessment and risk management 33 / 61

Deliverable 2

Stage Process Proc Benchmark Input Item Input Input Benchmark Output Item Output Output ess Score Score Scor e

6.1.1 Management education, and commitment to training infrmation security I.15.3 Awareness information 8.2.2 Information 1.5 O.15.3 Consulting request 6.1.7 Contact with 1,5 coming from relevant security to external specialists special interest sources (e.g. internal awareness, groups directives and rules for education and processing and using training information systems) I.15.4 Consulting reports from 6.1.8 Independent 2 O.15.4 Risk 6.1.2 Information 1 experts (internal and review of communication plan security external) information for the enterprise coordination security 15.2 Compliance with security policies and standards, and technical compliance 15.3.1 Information systems audit controls I.15.5 Requests for consulting 6.1.7 Contact with 1.5 on detailed security special interest issues, or to perform an groups evaluation activity. 6.1.8 Independent review of information security

ENISA ad hoc working group on risk assessment and risk management 34 / 61

Deliverable 2 Mapping the Benchmark to the IT-Grundschutz methodology ([BSI1], ([BSI2], ([BSI3])

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

A. P.1 1 I.1.1 Market information I.1.1. BSI Standard 100-2 O.1.1 All records of the O.1.1 BSI Standard 100-2 Definition Definition (market indicators, §3.1.1 Determining the external §3.1.1 Determining the of scope of external competitive information, environmental environment of the environmental conditions and environme etc.) conditions (1) organization (1) framework nt I.1.2 Financial & political I.1.2. BSI Standard 100-2 O.1.2 List of relevant O.1.2 BSI Standard 100-2 information §3.1.1 Determining the obligatory laws and §3.1.1 Determining the I.1.3 Relevant legal and environmental regulations (with environmental conditions regulatory information conditions (1) respect to (1) I.1.4 Information about I.1.3 BSI Standard 100-2 obligations) O.1.3 (0) geographical, social and §3.1.1 Determining the O.1.3 Various lists with cultural conditions environmental applicable rules I.1.5 Information about conditions (1) (social, cultural, external stakeholders I.1.4 BSI Standard 100-2 values etc.) (values and perception) §3.1.1 Determining the (Note: partners, environmental competitors, other conditions (1) dependencies) I.1.5 (0)

ENISA ad hoc working group on risk assessment and risk management 35 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

P.2 3 I.2.1 Strategy on the I.2.1 BSI Standard 100-2 O.2.1 Description of O.2.1 BSI-Standard 100-2 § Definition organization (goals, §3.1.2 Formulate internal roles (and 3.2 Setting Up an IT of internal objectives, strengths, General IT Security responsibilities) Security Organisation (3) environme weaknesses, Objectives (3) O.2.2 Description of the O.2.2 BSI-Standard 100-2 § nt opportunities and threats, I.2.2 BSI Standard 100-2 main business 3.1.3 Drawing up an culture, structure) §3.1.2 Formulate processes information security I.2.2 Description of internal General IT Security O.2.3 Description of policy (2) stakeholders Objectives (3) internal assets (e.g. O.2.3 BSI-Standard 100-2 § I.2.3 Assets in terms of I.2.3 BSI Standard 100-2 computing centre, 4.1.1 Documenting the resources (people, §3.1.2 Formulate cooling system, IT Assets §4.1.2 systems, processes, General IT Security heating system, Preparing a Network capital, etc.) Objectives (3) network, etc.) Plan §4.1.3 Collecting O.2.4 Description of Information on the IT relationships Systems §4.1.4 between O.2.2 and Collecting Information O.2.3 about the IT Applications O.2.5. List of strategies and Related Information (including IT- §4.1.5 Documenting the Strategy and IT- Rooms (3) security strategy, if O.2.4 BSI-Standard 100-2 §4 existing) 4.1 IT Structure Analysis O.2.6 Risk appetite or (3) tolerance (risk O.2.5 (0) orientation of the O.2.6 BSI Standard 100-2 organization) §3.1.2 Formulate General IT Security Objectives (3)

ENISA ad hoc working group on risk assessment and risk management 36 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

P.3 3 I.3.1 O.2.3 I.3.1 BSI-Standard 100-2 § O.3.1 Detailed O.3.1. BSI 100-2 § 4.2 Generatio I.3.2 Target object scope 4.1.1 Documenting the assessment/manage Defining Protection n of risk I.3.3 Scope of the assessment/ IT Assets (3) ment plan including: Requirements, §4.4 managem management activities I.3.2 BSI 100-2 §3.1.3 O.3.2 List of assigned Basic Security Check (3) ent (inclusion/exclusion of Drawing up an participants to roles O.3.2. BSI 100-2 §3.2 Setting context parts) information security in the assessment/ up an IT security I.3.4 Definition of roles policy (3) management organization (2) involved in the I.3.4. BSI 100-2 §3.2 activities O.3.3 BSI 100-2 § 3.1.3 assessment/management Setting up an IT O.3.3 List of other Drawing up an activity security organization activities and actions information security I.3.5 Dependencies with other (3) to be taken under policy (1,5) activities and, processes I.3.5. BSI 100-2 §3.2 consideration (e.g. O.3.4 BSI 100-2 § 3.1.2 Setting up an IT cooperation, Formulate general IT security organization, interfacing etc.) Security Objectives “Co-operation and O.3.4 Definition of the (content: general communication”, “IT organization and business processes coordination process to be security requirements committee” (2) assessed assessment) (2,5) P.4 3 I.4.1 Rules for impact I.4.1. BSI 100-2 § 4.2 O.4.1 List with criteria for O.4.1. BSI 100-2 § 4.2 Formulati acceptance including Defining Protection the forthcoming Defining Protection on of frequency, severity and Requirements, assessment activities Requirements, §4.5 impact value of assets affected “Defining protection O.4.2 Classification Integrating the limit I.4.2 Asset classification requirements scheme for assets Supplementary Security criteria reflecting the categories” (2,5) Analysis in the ITimportance/value of I.4.2. BSI 100-2 § 4.2 Grundschutz Approach assets to the business Defining Protection (3) Requirements (3) O.4.2. BSI 100-2 § 4.2 Defining Protection Requirements (3)

ENISA ad hoc working group on risk assessment and risk management 37 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

B. Risk P.5 2,5 I.5.1 Determined methodology I.5.1 BSI 100-2 §4.3.2 O.5.1 List of relevant O.5.1. Modules in the ITassessment Identificat to be used for the Modelling IT Assets, threats Grundschutz Catalogues ion of identification of risk (i.e. BSI 100-2 §4.5 O.5.2 List of relevant (1,5) risks threats, vulnerabilities Integrating the vulnerabilities of O.5.2. Modules in the ITand impacts) Supplementary (groups of) assets Grundschutz Catalogues I.5.2 Threats, vulnerabilities Security Analysis in O.5.3 List of relevant (1,5) and impact statements the IT-Grundschutz impacts O.5.3. Modules in the ITthat will be used in the Approach, BSI 100-3 O.5.4 List of values Grundschutz Catalogues, assessment §4 Determination of including frequency, BSI 100-3 §4 I.5.3 Historical information additional threats (3) severity and value of Determination of that can be used to assess I.5.2 Modules in the IT- assets affected additional threats (3) the likelihood of impact Grundschutz O.5.5 Documentation of O.5.4 (0) I.5.4 Checklists and tools for Catalogues (3) the identification O.5.5 BSI 100-3 §4 the assessment I.5.3 (0) method Determination of I.5.4 Modules in the IT- O.5.6 Likelihood data additional threats (2) Grundschutz (e.g. history O.5.6 (0) Catalogues, Cross database) O.5.7. BSI 100-3 §6 Handling reference tables, O.5.7 Justification for risks (2) GSTOOL (3) threats and vulnerabilities intentionally disregarded

ENISA ad hoc working group on risk assessment and risk management 38 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

P.6 3 I.6.1 All outputs from 5 above I.6.2. BSI 100-2 §4.1 IT O.6.1 Tables with assets O.6.1 BSI 100-2 §4.2 Analysis I.6.2 Lists with relevant structure Analysis (3) classified according Determination of of relevant detailed assets (drawn I.6.3. BSI 100-2 § 4.2 to the classification protection requirements risks from O.2.4) Defining Protection scheme (3) I.6.3 O.5.1 with information Requirements (3) O.6.2 List of threats and O.6.2 BSI 100-2 §4.3.2 about risk limits and I.6.4 BSI 100-2 §4.4 Basic vulnerabilities Modelling IT Assets, O.4.2 Security Check (3) relative to each asset BSI 100-3 §4 I.6.4 List of existing controls O.6.3 List of existing Determination of (technical / controls relative to additional threats (2,5) organizational) each asset (part of O.6.3 BSI 100-2 §4.4 Basic so-called gap Security Check (3) analysis) O.6.4 BSI 100-2 §4.3.2 O.6.4 List of impacts Modelling IT Assets, relative to each asset BSI 100-3 §4 O.6.5 List of risks relative Determination of to each asset additional threats (2) O.6.6 (According to the O.6.5 BSI 100-2 §4.3.2 analysis method) Modelling IT Assets, Qualified or BSI 100-3 §4 quantified risks Determination of relative to each asset additional threats (3) or asset group (with O.6.6 BSI 100-2 §4.3.2 consequences, Modelling IT Assets (3) likelihood, cumulative impact relative to each asset or asset group)

ENISA ad hoc working group on risk assessment and risk management 39 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

P.7 2,5 I.7.1 All outputs of 6 above (3) O.7.1 Formal decision by O.7.1 BSI 100-2 §4.5 Evaluatio Management about Integrating the n of risks I.7.2 All outputs of 4 previously analyzed Supplementary Security risks and about Analysis in the ITwhich risks will be Grundschutz Approach, treated (and possibly BSI 100-3 §6 Handling with what priority) risks (2,5) or left untreated C. Risk P.8 3 I.8.1 O.4.1 including the I.8.1 BSI 100-2 § 4.2 O.8.1 Risk treatment O.8.1 BSI 100-3 § 6 Handling treatment Identificat relevant limits for the Defining Protection options according to risks (2,5) ion of risks Requirements (3) risks (possibly options I.8.2 O.7.1 I.8.2 (2,5) classified according I.8.3 List of options for risk treatment I.8.3 BSI 100-3 § 6 to the risk limits) Handling risks (3) P.9 3 I.9.1 O.8.1 I.9.1 BSI 100-3 § 6 O.9.1 Action plan as O.9.1 BSI 100-2 §4.6 Developm I.9.2 Assigned organizational Handling risks (2,5) sequence of Implementation of IT ent of roles (e.g. from O.3.2) I.9.2 BSI 100-2 §3.2 Setting prioritized activities Security measures (3) action I.9.3 Possible planning up an IT security (expressed as O.9.2 BSI 100-2 §3.3 plan methodology I.9.4 Possible priority scheme organization (1,5) implementation of Provision of Resources to be used I.9.3 BSI 100-2 §4.6 controls or as for IT Security, Implementation of IT protection of assets) GSTOOL (3) Security measures (3) O.9.2 Assignment of O.9.3 IT-Grundschutz resources (e.g. costs) Catalogues, GSTOOL for action plan (3) implementation O.9.3 Assignment of responsibilities for each action

ENISA ad hoc working group on risk assessment and risk management 40 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

P.10 2,5 I.10.1 O.9.1 I.10.1 BSI 100-3 § 6 O.10.1 Approved lists BSI 100-2 §4.6 Approval Handling risks (2,5) with activities Implementation of IT of action I.10.2 Reports and I.10.2 BSI 100-2 §5.2 Security measures (3) plan presentation techniques for Information Flow in findings of I.10.1 the IT Security Process (1) P.11 2,5 I.11.1 O.9.1 I.11.1 BSI 100-3 § 6 O.11.1 Coordination of O.11.1 BSI 100-2 §5.2 Implemen Handling risks (2,5) activities Information Flow in the tation of I.11.2 O.3.3 I.11.2 BSI 100-2 § 3.1.2 O.11.2 Progress reports IT Security Process (1) action Formulate general IT from other projects O.11.2 (0) plan I.11.3 Reporting scheme from within other activities Security Objectives O.11.3 Progress reports O.11.3 BSI 100-2 §5.1 (2,5) from the Checking the IT Security I.11.4 Reporting on costs for implementation of Process at all Levels (2) implementation measurements (e.g. O.11.4 BSI 100-2 §5.1 from ISMS) Checking the IT Security O.11.4 Overview of costs Process at all Levels, GSTOOL (2) P.12 2 I.12.1 O.14.1 O.12.1 Triggering of O.12.1 (3) Identificat activities 6 and 7 O.12.2 BSI 100-3 §6 Handling ion of O.12.2 Evaluated residual risks (2) residual risks risks

ENISA ad hoc working group on risk assessment and risk management 41 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

D. Risk P.13 Risk 2 I.13.1 O.12.2 I.13.1 BSI 100-3 §6 O.13.1 Formal decision O.13.1 BSI 100-3 §6 Handling acceptance acceptanc Handling risks (2) by management on risks (2) e I.13.2 O.7.1 I.13.2 BSI 100-2 §4.5 the way risks have Integrating the been treated Supplementary Security Analysis in the IT-Grundschutz Approach, BSI 100-3 §6 Handling risks (2,5) E. Monitor P.14 Risk 2,5 I.14.1 External reference I.14.1 BSI 100-2 §5.2 O.14.1 Reports on events O.14.1 BSI 100-2 §5.2 and review monitorin documents e.g.: Information Flow in and consequences to Information Flow in the g and - Metrics methodologies the IT Security Process internal stakeholders IT Security Process (2) reporting - Incident data from (1) O.14.2 Reports on events O.14.2 (0) CERTs - Information from I.14.2 BSI 100-2 §5.2 and consequences to O.14.5 (0) dedicated security Information Flow in external concerned O.14.6 BSI 100-2 §3.3 organizations (ENISA, the IT Security Process parties (e.g. state Provision of Resources ISACA, SANS, NIST, (2) agencies and for IT Security, etc.) I.14.3 IT-Grundschutz stakeholders) GSTOOL (3) I.14.2 Internal reference samples of security O.14.5 Internal indicators documents: policies, IT- (e.g. KPIs) - O.7.1, O.13.1 Grundschutz security O.14.6 Cost indicators - O.11.3 measures (3)

ENISA ad hoc working group on risk assessment and risk management 42 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

I.14.3 Lists of Security I.14.4 BSI 100-2 §4.6 Policies Implementation of IT I.14.4 O.9.1 Security measures (3) I.14.5 Reports on incidents I.14.5 BSI 100-2 §5.2 from business processes I.14.6 O.9.2 (concerning costs) Information Flow in the IT Security Process, IT- Grundschutz Module “Incident handling” (3) I.14.6 BSI 100-2 §3.3 Provision of Resources for IT Security, GSTOOL (3)

ENISA ad hoc working group on risk assessment and risk management 43 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

F. Risk P.15 Risk 2 I.15.1 Reporting on incidents I.15.1 IT-Grundschutz O.15.1 Communication to O.15.1 BSI 100-2 §5.2 communic communic (external and internal) Module 1.8 “Incident internal and external Information Flow in the ation, ation, I.15.2 Requests to inform handling” (3) partners IT Security Process (2) awareness awareness Management arising I.15.2 BSI 100-2 §5.1 O.15.2 Awareness O.15.2 IT-Grundschutz and and from the risk treatment consulting consulting plan Checking the IT information for all Module 1.13 “IT security I.15.3 Awareness information Security Process at all involved awareness and training” coming from relevant Levels (2) stakeholders (3) sources (e.g. internal I.15.3 IT-Grundschutz O.15.3 Consulting request O.15.3 BSI 100-3 §5 4 directives and rules for Module 1.13 “IT to external Determination of processing and using information systems) security awareness and specialists additional threats (1) I.15.4 Consulting reports from training” (3) O.15.4 Risk O.15.4 BSI 100-2 §5.2 experts (internal and I.15.4 BSI 100-2 §5.2 communication plan Information Flow in the external) Information Flow in for the enterprise. IT Security Process (1) I.15.5 Requests for consulting the IT Security Process on detailed security issues, or to perform an (1) evaluation activity. I.15. BSI 100-3 §5 4 Determination of additional threats (1)

ENISA ad hoc working group on risk assessment and risk management 44 / 61

Deliverable 2 Annex C Mapping the Benchmark to the NIST SP 800-30 methodology ([NIST])

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

A. P.1 (0) I.1.1 Market information (market I.1.1 (0) O.1.1 All records of the O.1.1 (0) Definition Definitio indicators, competitive I.1.2 (0) external O.1.2 (0) environment of the O.1.3 (0) of scope n of information, etc.) I.1.3 (0) organization and external I.1.2 Financial & political I.1.4 (0) O.1.2 List of relevant framework environm information I.1.5 (0) obligatory laws and ent I.1.3 Relevant legal and regulatory regulations (with information respect to obligations) I.1.4 Information about O.1.3 Various lists with geographical, social and applicable rules cultural conditions (social, cultural, I.1.5 Information about external values etc.) stakeholders (values and perception) (Note: partners, competitors, other dependencies)

ENISA ad hoc working group on risk assessment and risk management 45 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

P.2 System I.2.1 Strategy on the organization I.2.1 (0) O.2.1 Description of O.2.1 Chapter 3.1: Definitio characterizat (goals, objectives, strengths, I.2.2 (0) internal roles (and System related n of ion weaknesses, opportunities I.2.3 Chapter 3.1: System responsibilities) information (1) internal (2) and threats, culture, structure) related information O.2.2 Description of the O.2.2 (0) environm I.2.2 Description of internal (hardware, software, main business O.2.3 Chapter 3.1: ent stakeholders system interfaces, processes System related I.2.3 Assets in terms of resources data and O.2.3 Description of information (1) (people, systems, processes, information, people, internal assets (e.g. O.2.4 (0) capital, etc.) functional computing centre, O.2.5 (0) requirements) (1) cooling system, O.2.6 (0) heating system, network, etc.) O.2.4 Description of relationships between O.2.2 and O.2.3 O.2.5. List of strategies (including IT- Strategy and ITsecurity strategy, if existing) O.2.6 Risk appetite or tolerance (risk orientation of the organization)

ENISA ad hoc working group on risk assessment and risk management 46 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

P.3 System I.3.1 O.2.3 I.3.1 O.2.3 (1) O.3.1 Detailed O.3.1. Generatio characterizat I.3.2 Target object scope I.3.2 Chapter 3.1: System assessment/manage O.3.2. (0) n of risk ion I.3.3 Scope of the assessment/ related information ment plan including: O.3.3 (0) managem (2) management activities (1) O.3.2 List of assigned O.3.4 Chapter 3.1: ent (inclusion/exclusion of parts) I.3.3 Chapter 3.1: System participants to roles System related context I.3.4 Definition of roles involved related information in the assessment/ information (1) in the (1) management assessment/management I.3.4. Chapter 3.1: System activities activity related information O.3.3 List of other activities I.3.5 Dependencies with other (1) and actions to be activities and, processes I.3.5. (0) taken under consideration (e.g. cooperation, interfacing etc.) O.3.4 Definition of the organization and process to be assessed P.4 System I.4.1 Rules for impact acceptance I.4.1. Chapter 3.1: System O.4.1 List with criteria for O.4.1. (0) Formulati characterizat including frequency, severity related information the forthcoming O.4.2. Chapter 3.7.1: on of ion and value of assets affected (1) assessment activities Risk level impact (2) I.4.2 Asset classification reflecting I.4.2 Chapter 3.1: System O.4.2 Classification scheme matrix (2) limit the importance/value of related information for assets criteria assets to the business (1)

ENISA ad hoc working group on risk assessment and risk management 47 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

B. Risk P.5 Threat I.5.1 Determined methodology to I.5.1 Chapter 3.7: Risk O.5.1 List of relevant threats O.5.1. Chapter 3.2: assessment Identifica identificatio be used for the identification determination (2) O.5.2 List of relevant Threat tion of n (2) of risk (i.e. threats, I.52 Chapter 3.2: Threat vulnerabilities of identification (1) risks vulnerabilities and impacts) identification (2) (groups of) assets Chapter 3.5: Vulnerabilit I.5.2 Threats, vulnerabilities and Chapter 3.3: O.5.3 List of relevant Likelihood y impact statements that will be Vulnerability impacts determination (2) identificatio used in the assessment identification (2) O.5.4 List of values O.5.2. Chapter 3.3: n (2) I.5.3 Historical information that Chapter 3.5: including frequency, Vulnerability can be used to assess the Likelihood severity and value of identification (1) Likelihood likelihood of impact determination (2) assets affected O.5.3. Chapter 3.6: determinatio I.5.4 Checklists and tools for the Chapter 3.6: Impact O.5.5 Documentation of the Impact analysis n (2) assessment analysis (2) identification method (1) I.5.3 (0) O.5.6 Likelihood data (e.g. O.5.4 (0) Impact I.5.4 Appendices A-C (2) history database) O.5.5 Chapter 3.7: risk analysis (2) O.5.7 Justification for determination (1) threats and O.5.6 (0) vulnerabilities O.5.7 (0) intentionally disregarded

ENISA ad hoc working group on risk assessment and risk management 48 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

P.6 Control I.6.1 All outputs from 5 above I.6.2. Chapter 3.1: System O.6.1 Tables with assets O.6.1 (0) Analysis analysis (2) I.6.2 Lists with relevant detailed related information classified according to O.6.2 Chapter 3.7.1: of assets (drawn from O.2.4) (1) the classification Risk level matrix relevant Impact I.6.3 O.5.1 with information about I.6.3. O.5.1 and risk level scheme (1,5) risks analysis (2) risk limits and O.4.2 matrix (1) O.6.2 List of threats and O.6.3 Chapter 3.7.1: I.6.4 List of existing controls I.6.4 Chapter 3.4: Control vulnerabilities relative Risk level matrix Risk (technical / organizational) analysis (1) to each asset (1,5) determinatio O.6.3 List of existing O.6.4 Chapter 3.7.1: n controls relative to Risk level matrix (2) each asset (part of so- (1,5) called gap analysis) O.6.5 Chapter 3.7.1: O.6.4 List of impacts Risk level matrix relative to each asset (1,5) O.6.5 List of risks relative O.6. Chapter 3.7.1: to each asset Risk level matrix O.6.6 (According to the (1,5) analysis method) Qualified or quantified risks relative to each asset or asset group (with consequences, likelihood, cumulative impact relative to each asset or asset group)

ENISA ad hoc working group on risk assessment and risk management 49 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

P.7 results I.7.1 All outputs of 6 above I.7.1 All outputs of 6 O.7.1 Formal decision by O.7.1 Chapter 3.9: Evaluatio documentati I.7.2 All outputs of 4 above (1) Management about Results n of risks on (2) I.7.2 All outputs of 4 (1) previously analyzed documentation risks and about which (1,5) risks will be treated (and possibly with what priority) or left untreated C. Risk P.8 control I.8.1 O.4.1 including the relevant I.8.1 (0) O.8.1 Risk treatment O.8.1 Chapter 4.1: Risk treatment Identifica recommenda limits for the risks I.8.2 O.7.1 (1,5) options according to mitigation tion of tion I.8.2 O.7.1 I.8.3 Chapter 4.1: Risk risks (possibly options (2), Risk options I.8.3 List of options for risk mitigation options classified according to mitigation treatment (2) the risk limits) strategy (2)

ENISA ad hoc working group on risk assessment and risk management 50 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

P.9 Prioritize I.9.1 O.8.1 I.9.1 O.8.1 (2) O.9.1 Action plan as O.9.1 Chapter 4.3: Develop actions (2) I.9.2 Assigned organizational roles I.9.2 Chapter 4.3: sequence of approach for ment of Evaluate (e.g. from O.3.2) approach for control prioritized activities control action recommende I.9.3 Possible planning implementation (1) (expressed as implementation, plan d control methodology I.9.3 (0) options (2) I.9.4 Possible priority scheme to be I.9.4 (0) implementation of step 6 (1,5) conduct used controls or as O.9.2 Chapter 4.3: cost-benefit protection of assets) approach for analysis O.9.2 Assignment of control (2) resources (e.g. costs) implementation, select controls (2) for action plan step 6 (1,5) assign implementation O.9.3 Chapter 4.3: responsibilit O.9.3 Assignment of approach for ies (2) responsibilities for control develop a each action implementation, safeguard implementat step 6 (1,5) ion plan (2) P.10 (0) I.10.1 O.9.1 I.10.1 (0) O.10.1 Approved lists with O.10.1 (0) Approval I.10.2 Reports and presentation I.10.2 (0) activities of action techniques for findings of plan I.10.1 P.11 Implement I.11.1 O.9.1 I.11.1 O.9.1 O.11.1 Coordination of O.11.1 (0) Impleme selected I.11.2 O.3.3 I.11.2 (0) activities O.11.2 (0) ntation of controls (1) I.11.3 Reporting scheme from I.11.3 (0) O.11.2 Progress reports O.11.3 Chapter 4.3: action within other activities I.11.4 (0) from other projects approach for plan I.11.4 Reporting on costs for O.11.3 Progress reports control implementation from the implementation, implementation of step 7 (1) measurements (e.g. O.11.4 (0) from ISMS) O.11.4 Overview of costs

ENISA ad hoc working group on risk assessment and risk management 51 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

P.12 residual risk I.12.1 O.14.1 I.12.1 (0) O.12.1 Triggering of O.12.1 ? Identifica (1) activities 6 and 7 tion of O.12.2 Evaluated residual O.12.2 Chapter 4.6: residual risks residual risk (1) risks D Risk P.13 Risk (0) I.13.1 O.12.2 I.13.1 (0) O.13.1 Formal decision by O.13.1 (0) acceptance acceptanc I.13.2 O.7.1 I.13.2 (0) management on the e way risks have been treated E Risk P.14 Risk (0) I.14.1 External reference I.14.1 (0) O.14.1 Reports on events O.14.1 (0) Monitor indicator documents e.g.: I.14.2 (0) and consequences to O.14.2 (0) and Review gathering - Metrics methodologies I.14.3 (0) internal stakeholders O.14.5 (0) and - Incident data from CERTs I.14.4 (0) O.14.2 Reports on events O.14.6 (0) reporting - Information from dedicated I.14.5 (0) and consequences to security organizations I.14.6 (0) external concerned (ENISA, ISACA, SANS, parties (e.g. state NIST, etc.) agencies and I.14.2 Internal reference stakeholders) documents: O.14.5 Internal indicators - O.7.1, O.13.1 (e.g. KPIs) - O.11.3 O.14.6 Cost indicators I.14.3 Lists of Security Policies I.14.4 O.9.1 I.14.5 Reports on incidents from business processes I.14.6 O.9.2 (concerning costs)

ENISA ad hoc working group on risk assessment and risk management 52 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input (Score) Benchmark Output Item Output (Score) Score

F. Risk P.15 Risk (0) I.15.1 Reporting on incidents I.15.1 (0) O.15.1 Communication to O.15.1 (0) communica communi (external and internal) I.15.2 (0) internal and external O.15.2 (0) tion, cation, I.15.2 Requests to inform I.15.3 (0) partners O.15.3 (0) awareness awarenes Management arising from the I.15.4 (0) O.15.2 Awareness O.15.4 (0) and s and risk treatment plan I.15.5 (0) information for all consulting consultin I.15.3 Awareness information involved g coming from relevant sources stakeholders (e.g. internal directives and O.15.3 Consulting request rules for processing and using to external information systems) specialists I.15.4 Consulting reports from O.15.4 Risk communication experts (internal and external) plan for the I.15.5 Requests for consulting on enterprise. detailed security issues, or to perform an evaluation activity.

ENISA ad hoc working group on risk assessment and risk management 53 / 61

Deliverable 2 Annex D Mapping the Benchmark to the Dutch A&K Analysis methodology ([DAK])

Stage Process Process Benchmark Input Item Input Input Benchmark Output Item Output Output Score Score Score

A. Definition P.1 Definition 0 I.1.1 Market information 0 O.1.1 All records of the 0 of scope and of external (market indicators, external environment framework environment competitive of the organization information, etc.) I.1.2 Financial & political 0 O.1.2 List of relevant 0 information obligatory laws and regulations (with respect to obligations) I.1.3 Relevant legal and 0 O.1.3 Various lists with 0 regulatory information applicable rules (social, cultural, values etc.) I.1.4 Information about 0 geographical, social and cultural conditions I.1.5 Information about 0 external stakeholders (values and perception) (Note: partners, competitors, other dependencies) P.2 Definition 1.3 I.2.1 Strategy on the 0 O.2.1 Description of Part 1,step 3 2 of internal organization (goals, internal roles (and and 4 environment objectives, strengths, responsibilities) weaknesses, opportunities and threats, culture, structure)

ENISA ad hoc working group on risk assessment and risk management 54 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input Input Benchmark Output Item Output Output Score Score Score

I.2.2 Description of internal Part 2, step 1: 2 O.2.2 Description of the Part 2, step 2 stakeholders Focus and main business 2+3: scope processes Description of Part 2, step 2: business Business processes processes I.2.3 Assets in terms of Part 2, step 4: 2 O.2.3 Description of Part 2, step 2 resources (people, System internal assets (e.g. 4+5: systems, processes, information computing centre, Description of capital, etc.) (assets, cooling system, system assets documentation) heating system, network, etc.) O.2.4 Description of Part 2, step 6: 2 relationships between Description of O.2.2 and O.2.3 relationships between O.2.2 and O.2.3 O.2.5. List of strategies 0 (including IT- Strategy and ITsecurity strategy, if existing) O.2.6 Risk appetite or 0 tolerance (risk orientation of the organization) P.3 0.7 I.3.1 O.2.3 0 O.3.1 Detailed 0 Generation of assessment/managem risk ent plan including: management context

ENISA ad hoc working group on risk assessment and risk management 55 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input Input Benchmark Output Item Output Output Score Score Score

I.3.2 Target object scope 0 O.3.2 List of assigned Part 1 ,step 5 2 participants to roles in and 6 the assessment/ management activities I.3.3 Scope of the Part I ,step 5 1 O.3.3 List of other activities Part 1 ,step 5 2 assessment/ and actions to be and 6 management activities taken under (inclusion/exclusion of consideration (e.g. parts) cooperation, interfacing etc.) I.3.4 Definition of roles Part 1 , step 3 1 O.3.4 Definition of the 0 involved in the organization and assessment/managemen process to be assessed t activity I.3.5 Dependencies with 0 other activities and, processes P.4 0.3 I.4.1 Rules for impact Part 1 ,step 22 1 O.4.1 List with criteria for 0 Formulation acceptance including to 13 the forthcoming of impact frequency, severity and assessment activities limit criteria value of assets affected I.4.2 Asset classification 0 O.4.2 Classification scheme 0 reflecting the for assets importance/value of assets to the business B. Risk P.5 1.5 I.5.1 Determined Part 1: 2 O.5.1 List of relevant Part 2, step 10: 2 assessment Identification methodology to be used Description of threats List of threats of risks for the identification of risk assessment risk (i.e. threats, methodology vulnerabilities and impacts)

ENISA ad hoc working group on risk assessment and risk management 56 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input Input Benchmark Output Item Output Output Score Score Score

I.5.2 Threats, vulnerabilities Part 2, step 10: 2 O.5.2 List of relevant Part 2, step 9: 2 and impact statements Asset, threat vulnerabilities of List of system that will be used in the and impact lists (groups of) assets components assessment I.5.3 Historical information 0 O.5.3 List of relevant Part 2, step 10 2 that can be used to impacts + 11: List of assess the likelihood of relevant impact impacts I.5.4 Checklists and tools for Part 3, 2 O.5.4 List of values 0 the assessment appendices : including frequency, Checklists and severity and value of examples assets affected O.5.5 Documentation of the Part 3, 2 identification method appendices O.5.6 Likelihood data (e.g. 0 history database) O.5.7 Justification for Part 2, step 11 2 threats and + 12: selection vulnerabilities and intentionally justification of disregarded controls P.6 Analysis 2 I.6.1 All outputs from 5 Outputs from 2 O.6.1 Tables with assets Part 2, step 9: 2 of relevant above P.5 classified according Tables with risks to the classification assets scheme I.6.2 Lists with relevant Lists with 2 O.6.2 List of threats and Part 3, 2 detailed assets (drawn relevant vulnerabilities appendices from O.2.4) detailed assets relative to each asset from O.5.2 I.6.3 O.5.1 with information Outputs from 2 O.6.3 List of existing Part 2, step 8: 2 about risk limits and P.5 controls relative to List of existing O.4.2 each asset (part of so- controls called gap analysis)

ENISA ad hoc working group on risk assessment and risk management 57 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input Input Benchmark Output Item Output Output Score Score Score

I.6.4 List of existing controls Part 2, step 8: 2 O.6.4 List of impacts Part 3, 2 (technical / List of existing relative to each asset appendices organizational) controls O.6.5 List of risks relative Part 3, 2 to each asset appendices O.6.6 (According to the Part 3, 2 analysis method) appendices Qualified or quantified risks relative to each asset or asset group (with consequences, likelihood, cumulative impact relative to each asset or asset group) P.7 0.7 I.7.1 All outputs of 6 above All outputs of 6 1 O.7.1 Formal decision by Part 2, step 11: 1 Evaluation of above (1) Management about Identification risks previously analyzed of relevant risks and about which risks risks will be treated (and possibly with what priority) or left untreated I.7.2 All outputs of 4 0 C. Risk P.8 1.5 I.8.1 O.4.1 including the 0 O.8.1 Risk treatment Part 2, step 12: 2 treatment Identification relevant limits for the options according to List of of options risks risks (possibly recommended classified according controls; to the risk limits) Part 2, step 13 + 14: Evaluation of controls I.8.2 O.7.1 O.7.1 (2) 2

ENISA ad hoc working group on risk assessment and risk management 58 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input Input Benchmark Output Item Output Output Score Score Score

I.8.3 List of options for risk Part 2, step 12: 2 treatment List of relevant controls (2) P.9 0.4 I.9.1 O.8.1 0 O.9.1 Action plan as Part 1 step 5 1 Development sequence of of action plan prioritized activities (expressed as implementation of controls or as protection of assets) I.9.2 Assigned organizational 0 O.9.2 Assignment of 0 roles (e.g. from O.3.2) resources (e.g. costs) for action plan implementation I.9.3 Possible planning Part 1 ,step 5 1 O.9.3 Assignment of Part 1 ,step 5 1 methodology responsibilities for and 6 each action I.9.4 Possible priority 0 scheme to be used P.10 0 I.10.1 O.9.1 0 O.10.1 Approved lists with 0 Approval of activities action plan I.10.2 Reports and 0 presentation techniques for findings of I.10.1 P.11 0 I.11.1 O.9.1 0 O.11.1 Coordination of 0 Implementati activities on of action plan I.11.2 O.3.3 0 O.11.2 Progress reports 0 from other projects

ENISA ad hoc working group on risk assessment and risk management 59 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input Input Benchmark Output Item Output Output Score Score Score

I.11.3 Reporting scheme 0 O.11.3 Progress reports 0 from within other from the activities implementation of measurements (e.g. from ISMS) I.11.4 Reporting on costs for 0 O.11.4 Overview of costs 0 implementation P.12 0.7 I.12.1 O.14.1 Outputs of P.6 0 O.12.1 Triggering of 0 Identification and O.8.1 activities 6 and 7 of residual risks O.12.2 Evaluated residual Part 2, step 13 2 risks + 14: Residual risks D. Risk P.13 Risk 0 I.13.1 O.12.2 0 O.13.1 Formal decision by 0 acceptance acceptance management on the way risks have been treated I.13.2 O.7.1 0 E. Monitor P.14 Risk 0.3 I.14.1 External reference several times 1 O.14.1 Reports on events 0 and review monitoring documents e.g.: especially DR and consequences to and reporting - Metrics methodologies 1,step 13 internal stakeholders - Incident data from CERTs - Information from dedicated security organizations (ENISA, ISACA, SANS, NIST, etc.) I.14.2 Internal reference 0 O.14.2 Reports on events 0 documents: and consequences to - O.7.1, O.13.1 external concerned - O.11.3 parties (e.g. state agencies and stakeholders) I.14.3 Lists of Security 0 O.14.3 Internal indicators 0 Policies (e.g. KPIs)

ENISA ad hoc working group on risk assessment and risk management 60 / 61

Deliverable 2

Stage Process Process Benchmark Input Item Input Input Benchmark Output Item Output Output Score Score Score

I.14.4 O.9.1 0 O.14.4 Cost indicators Part 1,step 12 1 I.14.5 Reports on incidents Part 1, step 13 1 from business processes I.14.6 O.9.2 (concerning 0 costs) F Risk P.15 Risk 0 I.15.1 Reporting on incidents 0 O.15.1 Communication to 0 communicati communicatio (external and internal) internal and external on, n, awareness partners awareness and and consulting

consulting

I.15.2 Requests to inform 0 O.15.2 Awareness 0 Management arising information for all from the risk treatment involved stakeholders plan I.15.3 Awareness 0 O.15.3 Consulting request 0 information coming to external specialists from relevant sources (e.g. internal directives and rules for processing and using information systems) I.15.4 Consulting reports 0 O.15.4 Risk communication 0 from experts (internal plan for the enterprise and external) I.15.5 Requests for 0 consulting on detailed security issues, or to perform an evaluation activity.

ENISA ad hoc working group on risk assessment and risk management 61 / 61