Expert Advice Community

Guest

Assessing the risks after the controls are applied

  Quote
Guest
Guest user Created:   Jan 12, 2016 Last commented:   Jan 12, 2016

Assessing the risks after the controls are applied

However lets elevate your example (in article https://advisera.com/27001academy/knowledgebase/how-to-assess-consequences-and-likelihood-in-iso-27001-risk-analysis/) by adding controls to come up with residual risk measurement. I believe that risk assessment, in general, would involve controls assessment.
0 0

Assign topic to the user

ISO 27001 RISK ASSESSMENT AND RISK TREATMENT METHODOLOGY

Define main rules for risk assessment and treatment.

ISO 27001 RISK ASSESSMENT AND RISK TREATMENT METHODOLOGY

Define main rules for risk assessment and treatment.

Guest
DejanK Jan 12, 2016

Basically you should assess the residual risks using the same criteria as described in the article you're referring to - this means you have to think how the consequences would be decreased when the controls are applied, and also how the likelihood would be decreased in the same case.

For more information please read this article “Why is residual risk so important?” : https://advisera.com/27001academy/knowledgebase/why-is-residual-risk-so-important/
Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Jan 12, 2016

Jan 12, 2016