Risk Assessment vs Security Assessment vs Gap Analysis
If just risk assessment would be conducted how would that be identified and evaluated. As mentioned above does security assessment and gap analysis should be part of risk assessment?
My second question is when you engage an external vendor to perform a risk assessment of your environment, covering infrastructure, applications, people, and processes, do you typically provide them with all the relevant information before receiving a commercial proposal?
IT Risk assessment does not include VAPT. The latter is security assessment or testing instead. There will be risk assessment in the test findings when their impacts are translated into residual risks with mitigation in event that they are cannot be remediated.
ASKER
We have been asked by the external auditors to conduct an IT risk assessment to evaluate the extent to which the organization relies on individual components, such as infrastructure, personnel, business applications, processes etc.
Having said, we want to hire third party to help us conducting IT risk assessment and I am preparing the scope
What exactly my scoping should include?
Furthermore, do I need to include security assessment and gap analysis as well.
Appreciate your thoughts.
ASKER
That can be one approach, and you can think of it as people, process and technology domains. So it is more holistic coverage. It is likely for each domain, it will also blend in the gap analysis in the compliance of the policies that the company is regulated. That is alright but can make it clear risk assessment has to take precedence with the risk scenario rather than dependent on control compliance check (this is not audit exercise).
ASKER
Is it a security assessment or IT risk assessment?
It still belongs to IT security assessment. Where would your data be stored in IT systems and are they adequately protected logically and physically? Who have access to the data stored and whether they are authorised from technical and process aspect that include background clearance.
If you are focusing on cybersecurity assessment (which is subset of IT security) then these two will be of lesser focus as concern is to mitigate cyber attack. So it depends on how wide that you will want to risk assess.
Security assessment as shared previously is on security testing. So if focusing on the basic hygiene, VAPT is sufficient which doesn't goes into the extend of testing physical and people security. However, if you going for more indepth testing such as adversary simulation and red teaming, these may consider social engineering and phishing attacks to get their way into your crown jewels. And of course, this can even include actual attacker wanting to physically bypass sentry and see how far they can gain physical entry.
ASKER
ASKER
IT Risk Assessment: Identification and evaluation of risks associated with an organization's IT systems, network equipment, and software applications. These risks may pertain to cybersecurity, data privacy, compliance, and continuity of business operations and personnel.
Does this include penetration testing and vulnerability assessment?
Security assessment: It is a more comprehensive approach that examines an organization's overall security posture, encompassing physical security, personnel security, and data/information security. This may involve evaluating risks related to cyber-attacks, data breaches, and other security threats.
Gap analysis: This aims to identify the differences between an organization's current state and a desired state, which may be guided by industry standards or best practices like ISO27001, NIST CSF, or industry-specific regulations. This can include pinpointing gaps in security controls, policies, and procedures.