Expert Advice Community

Guest

Is assessing asset value mandatory?

  Quote
Guest
Guest user Created:   Feb 08, 2016 Last commented:   Feb 08, 2016

Is assessing asset value mandatory?

I happened to listen to the recording of your webinar on 'Basics of RIsk Assessment and Treatment'.
0 0

Assign topic to the user

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

Expert
Dejan Kosutic Feb 08, 2016

It is very useful. A clarification: In your Risk value calculation, you are considering only the Impact & Probability.
Do we have to consider the Asset value also. Please clarify.

Answer:

ISO 27001 does not require you to assess the asset value - this is actually one of the greatest myths about risk assessment; what ISO 27001 does require you is to assess impact and likelihood. Of course, if you want to, you can assess asset value, but then you should assess these 3 items: asset value, threats and vulnerabilities (instead of only impact and likelihood).

This article explains this into more detail: How to assess consequences and likelihood in ISO 27001 risk analysis https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#assessment

Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Feb 08, 2016

Feb 08, 2016