Mastering the Risk Management Framework Revision 2


Book Description

This book provides an in-depth look at the Risk Management Framework (RMF) and the Certified Authorization Professional (CAP) (c) certification. This edition includes detailed information about the RMF as defined in both NIST SP 800-37 Revision 1 and NIST SP 800-37 Revision 2 as well as the changes to the CAP introduced on October 15th, 2018. Each chapter focuses on a specific portion of the RMF/CAP and ends with questions that will validate understanding of the topic. The book includes links to templates for all of the key documents required to successfully process information systems or common control sets through the RMF. By implementing security controls and managing risk with the RMF system owners ensure compliance with FISMA as well as NIST SP 800-171.




Operational Risk Management


Book Description

OpRisk Awards 2020 Book of the Year Winner! The Authoritative Guide to the Best Practices in Operational Risk Management Operational Risk Management offers a comprehensive guide that contains a review of the most up-to-date and effective operational risk management practices in the financial services industry. The book provides an essential overview of the current methods and best practices applied in financial companies and also contains advanced tools and techniques developed by the most mature firms in the field. The author explores the range of operational risks such as information security, fraud or reputation damage and details how to put in place an effective program based on the four main risk management activities: risk identification, risk assessment, risk mitigation and risk monitoring. The book also examines some specific types of operational risks that rank high on many firms' risk registers. Drawing on the author's extensive experience working with and advising financial companies, Operational Risk Management is written both for those new to the discipline and for experienced operational risk managers who want to strengthen and consolidate their knowledge.




Measuring and Managing Information Risk


Book Description

Using the factor analysis of information risk (FAIR) methodology developed over ten years and adopted by corporations worldwide, Measuring and Managing Information Risk provides a proven and credible framework for understanding, measuring, and analyzing information risk of any size or complexity. Intended for organizations that need to either build a risk management program from the ground up or strengthen an existing one, this book provides a unique and fresh perspective on how to do a basic quantitative risk analysis. Covering such key areas as risk theory, risk calculation, scenario modeling, and communicating risk within the organization, Measuring and Managing Information Risk helps managers make better business decisions by understanding their organizational risk. - Uses factor analysis of information risk (FAIR) as a methodology for measuring and managing risk in any organization. - Carefully balances theory with practical applicability and relevant stories of successful implementation. - Includes examples from a wide variety of businesses and situations presented in an accessible writing style.




The Complete Guide to Cybersecurity Risks and Controls


Book Description

The Complete Guide to Cybersecurity Risks and Controls presents the fundamental concepts of information and communication technology (ICT) governance and control. In this book, you will learn how to create a working, practical control structure that will ensure the ongoing, day-to-day trustworthiness of ICT systems and data. The book explains how to establish systematic control functions and timely reporting procedures within a standard organizational framework and how to build auditable trust into the routine assurance of ICT operations. The book is based on the belief that ICT operation is a strategic governance issue rather than a technical concern. With the exponential growth of security breaches and the increasing dependency on external business partners to achieve organizational success, the effective use of ICT governance and enterprise-wide frameworks to guide the implementation of integrated security controls are critical in order to mitigate data theft. Surprisingly, many organizations do not have formal processes or policies to protect their assets from internal or external threats. The ICT governance and control process establishes a complete and correct set of managerial and technical control behaviors that ensures reliable monitoring and control of ICT operations. The body of knowledge for doing that is explained in this text. This body of knowledge process applies to all operational aspects of ICT responsibilities ranging from upper management policy making and planning, all the way down to basic technology operation.




Risk Management and Governance


Book Description

Risk is a popular topic in many sciences - in natural, medical, statistical, engineering, social, economic and legal disciplines. Yet, no single discipline can grasp the full meaning of risk. Investigating risk requires a multidisciplinary approach. The authors, coming from two very different disciplinary traditions, meet this challenge by building bridges between the engineering, the statistical and the social science perspectives. The book provides a comprehensive, accessible and concise guide to risk assessment, management and governance. A basic pillar for the book is the risk governance framework proposed by the International Risk Governance Council (IRGC). This framework offers a comprehensive means of integrating risk identification, assessment, management and communication. The authors develop and explain new insights and add substance to the various elements of the framework. The theoretical analysis is illustrated by several examples from different areas of applications.




The Complete Guide to Business Risk Management


Book Description

Risk management and contingency planning has really come to the fore since the first edition of this book was originally published. Computer failure, fire, fraud, robbery, accident, environmental damage, new regulations - business is constantly under threat. But how do you determine which are the most important dangers for your business? What can you do to lessen the chances of their happening - and minimize the impact if they do happen? In this comprehensive volume Kit Sadgrove shows how you can identify - and control - the relevant threats and ensure that your company will survive. He begins by asking 'What is risk?', 'How do we assess it?' and 'How can it be managed?' He goes on to examine in detail the key danger areas including finance, product quality, health and safety, security and the environment. With case studies, self-assessment exercises and checklists, each chapter looks systematically at what is involved and enables you to draw up action plans that could, for example, provide a defence in law or reduce your insurance premium. The new edition reflects the changes in the global environment, the new risks that have emerged and the effect of macroeconomic factors on business profitability and success. The author has also included a set of case studies to illustrate his ideas in practice.




Executive's Guide to COSO Internal Controls


Book Description

Essential guidance on the revised COSO internal controls framework Need the latest on the new, revised COSO internal controls framework? Executive's Guide to COSO Internal Controls provides a step-by-step plan for installing and implementing effective internal controls with an emphasis on building improved IT as well as other internal controls and integrating better risk management processes. The COSO internal controls framework forms the basis for establishing Sarbanes-Oxley compliance and internal controls specialist Robert Moeller looks at topics including the importance of effective systems on internal controls in today's enterprises, the new COSO framework for effective enterprise internal controls, and what has changed since the 1990s internal controls framework. Written by Robert Moeller, an authority in internal controls and IT governance Practical, no-nonsense coverage of all three dimensions of the new COSO framework Helps you change systems and processes when implementing the new COSO internal controls framework Includes information on how ISO internal control and risk management standards as well as COBIT can be used with COSO internal controls Other titles by Robert Moeller: IT Audit, Control, and Security, Executives Guide to IT Governance Under the Sarbanes-Oxley Act, every corporation has to assert that their internal controls are adequate and public accounting firms certifying those internal controls are attesting to the adequacy of those same internal controls, based on the COSO internal controls framework. Executive's Guide to COSO Internal Controls thoroughly considers improved risk management processes as part of the new COSO framework; the importance of IT systems and processes; and risk management techniques.




Implementing Enterprise Risk Management


Book Description

A practical, real-world guide for implementing enterprise risk management (ERM) programs into your organization Enterprise risk management (ERM) is a complex yet critical issue that all companies must deal with in the twenty-first century. Failure to properly manage risk continues to plague corporations around the world. ERM empowers risk professionals to balance risks with rewards and balance people with processes. But to master the numerous aspects of enterprise risk management, you must integrate it into the culture and operations of the business. No one knows this better than risk management expert James Lam, and now, with Implementing Enterprise Risk Management: From Methods to Applications, he distills more than thirty years' worth of experience in the field to give risk professionals a clear understanding of how to implement an enterprise risk management program for every business. Offers valuable insights on solving real-world business problems using ERM Effectively addresses how to develop specific ERM tools Contains a significant number of case studies to help with practical implementation of an ERM program While Enterprise Risk Management: From Incentives to Controls, Second Edition focuses on the "what" of ERM, Implementing Enterprise Risk Management: From Methods to Applications will help you focus on the "how." Together, these two resources can help you meet the enterprise-wide risk management challenge head on—and succeed.




Safety and Security of Cyber-Physical Systems


Book Description

Cyber-physical systems (CPSs) consist of software-controlled computing devices communicating with each other and interacting with the physical world through sensors and actuators. Because most of the functionality of a CPS is implemented in software, the software is of crucial importance for the safety and security of the CPS. This book presents principle-based engineering for the development and operation of dependable software. The knowledge in this book addresses organizations that want to strengthen their methodologies to build safe and secure software for mission-critical cyber-physical systems. The book: • Presents a successful strategy for the management of vulnerabilities, threats, and failures in mission-critical cyber-physical systems; • Offers deep practical insight into principle-based software development (62 principles are introduced and cataloged into five categories: Business & organization, general principles, safety, security, and risk management principles); • Provides direct guidance on architecting and operating dependable cyber-physical systems for software managers and architects.