Ask the Expert

Risk assessment vs. risk analysis vs. risk management

Can you tell me what the difference is between information security risk assessment, risk analysis and risk management?

    Requires Free Membership to View

    Login

While there are different definitions of the above, here's the simplest:
  • A risk analysis involves identifying the most probable threats to an organization and analyzing the related vulnerabilities of the organization to these threats.

  • A risk assessment involves evaluating existing security and controls and assessing their adequacy relative to the potential threats of the organization.

  • Risk management is the systematic application of management policies, procedures and practices to the tasks of establishing the context, identifying, analyzing, evaluating, treating, monitoring and communicating risk.

This was first published in September 2005

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.
    Back to top