Page 187 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Operational costs of asset presence and loss

Liability of asset loss

Usefulness
Assigning or determining the value of assets to an organization can

fulfill numerous requirements. It serves as the foundation for
performing a cost/benefit analysis of asset protection through
safeguard deployment. It serves as a means for selecting or evaluating
safeguards and countermeasures. It provides values for insurance
purposes and establishes an overall net worth or net value for the

organization. It helps senior management understand exactly what is
at risk within the organization. Understanding the value of assets also
helps to prevent negligence of due care and encourages compliance
with legal requirements, industry regulations, and internal security
policies.

Risk reporting is a key task to perform at the conclusion of a risk
analysis. Risk reporting involves the production of a risk report and a

presentation of that report to the interested/relevant parties. For
many organizations, risk reporting is an internal concern only,
whereas other organizations may have regulations that mandate third-
party or public reporting of their risk findings.

A risk report should be accurate, timely, comprehensive of the entire
organization, clear and precise to support decision making, and
updated on a regular basis.

Continuous Improvement

Risk analysis is performed to provide upper management with the
details necessary to decide which risks should be mitigated, which
should be transferred, which should be deterred, which should be
avoided, and which should be accepted. The result is a cost/ benefit

comparison between the expected cost of asset loss and the cost of
deploying safeguards against threats and vulnerabilities. Risk analysis
identifies risks, quantifies the impact of threats, and aids in budgeting
for security. It helps integrate the needs and objectives of the security
policy with the organization’s business goals and intentions. The risk