Analyzing the Organization

Protecting an organization before, during, and after an attack requires solid knowledge of the organization’s most important assets. It is also essential to have a clear understanding of how disruption, modification, and disclosure of information and information systems could affect the ability of the organization to perform its vital business processes and activities. In addition, it is essential to know which information is particularly important for the organization and what risks information assets are exposed to. Therefore, asset management and risk assessment are central to evaluating the current risk situation and prioritizing the implementation of resilience measures. Thus, this chapter outlines essential risk management concepts, highlights the critical risk management tasks, and provides an introduction to business impact analysis.