Require specific written approval each time an individual needs to access the information

Increase security controls on the information

Decrease the classification label on the information

Decrease the security level on the information to ensure accessibility and usability of the information

Data owners

Administrators

Management

Users

The cost/benefit relationship

The confidence of the security the mechanism is providing

The data classification after the security mechanism has been implemented

The controls the security mechanism will enforce

(Threats x asset value x vulnerability) x risks

Threats x risk x asset value

(Threats x vulnerability x asset value) x controls gap

SLE x frequency = ALE

A method that assigns monetary values to components in the risk assessment

A method used to apply severity levels to potential loss, probability of loss, and risks

A method that is based on gut feelings and opinions

A scenario-based analysis to research different security threats

It assigns severity levels. Thus, it is hard to translate into monetary values

It is dealing with purely quantitative elements

It is possible, which is why it is used

Quantitative measures must be applied to quantitative elements

A standard on how to protect personal health information

The new version of NIST 800-60

The new version of BS 17799

Definitions for the new ISO 27000

COSO is a risk management approach that pertains to control objectives and IT business processes

COSO is a risk management system used for the protection of federal systems

COSO addresses corporate culture and policy development

Prevention of a corporate environment that allows for and promotes financial fraud

NIST 800-30 is IT based, while OCTAVE and AS/NZS 4360 are corporate based

NIST 800-30 and OCTAVE are corporate based, while AS/NZS is international

NIST 800-30 and AS/NZS are corporate based, while OCTAVE is international

AS/NZS is IT based, and OCTAVE and NIST 800-30 are assurance based

Capability Maturity Model Integrated (CMMI) should be integrated because it provides distinct maturity levels

Information Technology Infrastructure Library should be integrated because it allows for the mapping of IT service process management, business drivers, and security improvement

The Open Group Architecture Framework should be integrated because it provides a structure for process improvement

Six Sigma should be integrated because it allows for the defects of security processes to be identified and improved upon

Information security management systems — Overview and vocabulary

Code of practice for information security management

Information technology - Security Techniques - Information security management systems — Requirements

Information security management system implementation guidance

Information security management — Measurement

Information security management systems — Overview and vocabulary

Information technology - Security Techniques - Information security management systems — Requirements

Code of practice for information security management