0800 / 27 00 001
We are thrilled to serve you
Risk management tool
Business impact analyses, protection needs analyses and ICT risk management are interdependent. For efficient ICT risk management, we can offer you an Excel tool with which you can perform the following tasks.
- Recording the business processes and required IT resources
- Definition of data categories, whereby a ready-made set of data categories is available that can be customized. These data categories are then evaluated with regard to the VIVA protection objectives of confidentiality, integrity, availability and authenticity and are taken into account in the business impact analysis and the protection requirements analysis. The data categories are evaluated according to the values “normal”, “high” and “very high”.
- Assignment of the data categories to the business processes and IT resources. This results in the protection requirements of the business process and the associated IT resources
- Assessment of the degree of implementation of the catalog of target measures. This is based on the measures from the “ISO 27002” standard. The target measures are divided into the three protection requirement classes “Normal”, “High” and “Very high”.
- Performing the protection requirements analysis by calculating the protection requirements of the business processes and IT resources. This is done using a gap analysis. This first determines the measures that need to be taken to ensure the required level of protection. Based on the implementation status of the target measures, the extent to which gaps exist and measures still need to be implemented can be determined. A graphical representation is generated from this, from which the gap and thus a risk value is derived.
- Carrying out the business impact analysis by evaluating the failure of business processes in terms of financial, operational, legal and personnel consequences as well as possible effects on the company's image.
- Implementation of ICT risk management consisting of recording, classifying and evaluating risks
- Determining the risk strategy, defining measures and assigning them to risk owners
- Determining the effectiveness of the measures taken
- Preparation of a report whose details are summarized and aggregated from the respective subject areas. The report has a management summary that works with status tables so that potential problems can be identified at a glance.
The following anonymized report provides an impression of which topics can be dealt with using this risk tool and at what level of detail.
This risk tool greatly simplifies the handling of ICT risk management and is available on request.
We would be happy to provide you with information in an initial free and non-binding consultation.