Last week we tackled the different types/methods of cyber attacks and the potential impact they could have on organizations. In the past we spoke about vulnerabilities.
Matching vulnerabilities with willing and able threats constitutes a risk. This week we will be introduced to some risk management frameworks, and we shall grapple certain conditions for “acceptance” as a risk treatmment. Top of Form
NIST 800-30, OCTAVE, and ISO 27005 are Risk Management Frameworks that are used by organizations of different types. Which one of these are you familiar with? And, in comparison to the others, which do you think is most effective and why? The site below gives a good introductory summary:
Comparison between ISO 27005, OCTAVE & NIST SP 800-30 | SISA Blog (sisainfosec.com)
In addition to your response, give a circumstance where you think it might be appropriate for an organization to “accept” a risk.