YOUR IT RISK ASSESSMENT CHECKLIST

1. YOUR IT RISK ASSESSMENT CHECKLIST YOUR IT RISK ASSESSMENT CHECKLIST WHY DO YOU NEED AN IT SECURITY RISK ASSESSMENT? WHY DO YOU NEED AN IT SECURITY RISK ASSESSMENT? The world has gone digital, and so have businesses. Your business heavily relies on IT systems to perform a significant number of tasks, so you need to manage any potential problems that could disrupt your business. As a business, you are responsible for sensitive customer and employee data and safeguarding electronic financial transactions. IT threats result in financial loss, data loss, downtime, conflict with clients, or even legal consequences. You need to stay ahead of potential problems, and an IT security risk assessment is key in accomplishing this goal. A security risk assessment helps you eliminate or manage the threats, create a response and recovery plan, and ensure the continuity of your business even after a crisis. IT SECURITY RISK ASSESSM IT SECURITY RISK ASSESSMENT CHECKLIST ENT CHECKLIST 1.IDENTIFY ASSETS 1.IDENTIFY ASSETS

2. The first thing that you need to do on your risk assessment checklist is to identify all your valuable assets. Valuable assets include hardware, software, and data. This ranges from your business servers, customer data, credit card information, websites, applications, trade secrets and proprietary information, contracts, contact information, and your network. Anything whose loss or damage could lead to monetary losses or system downtime should be identified. Since most organizations have a limited budget for risk assessment, you will likely need to limit the scope of coverage of your assets. Accordingly, first define what constitutes an important asset and how it is categorized per category (major, average or minor) by management based on its monetary value or legal standing. To do so means limiting which assets are considered “critical” according to these criteria once they’ve been established rather than simply assessing all possible risks indiscriminately as one might otherwise take more time (and money) if given no guidelines whatsoever. 2.IDENTIFY THREATS 2.IDENTIFY THREATS In cyber security, threats, vulnerabilities, and risks are closely related. A threat is anything that can harm your business by exploiting a vulnerability. Threats can come from: Malicious actions like cyber attacks. Malicious cyber attacks can have a devastating effect on businesses and individuals. One such example of how these actions could be damaging is if an attacker was able to gain access to a bank’s customer records. They would have a complete record of the customers’ personal information, earnings, loan history, investments, transactional history, and more. In the wrong hands, this information can be used to bring your customers harm, e.g, by facilitating identity theft, siphoning of their funds, credit card fraud, etc. Their private information might even end up being used against them by scammers who try to sell bogus products and offers. Personnel impersonification. IT risk is ramping up because of personnel impersonification. IT risks are more prevalent now than ever before. A major reason for this is the increased number of people working remotely and using their company’s network to access sensitive data such as social security numbers, bank account information, etc. Due to this factor, hackers are finding it easier to leverage poorly designed systems and networks that allow them access without proper identification checks or background investigations. Accidental human intrusion. A risk to IT systems in many organizations may come from accidental human intrusion, which can occur through data entry errors and improper process execution (e.g., when someone enters incorrect information such as SQL commands into a database). This type of accident leads to system vulnerability that could be exploited by attackers with or without authorization, either within or outside the organization’s

3. borders who want access to sensitive business records and customer files for criminal purposes. In some cases, these hackers are able not only to get access but also to extract sensitive information from these secured systems. Your data is not safe from natural disasters! This includes tornadoes, earthquakes, floods, and more. If you are considering where to house your servers for the best protection against different types of natural hazards, then think about what type of disaster might happen in your area before picking a spot that may be vulnerable to such events. The probability of hardware failure is hard to predict, but for newer equipment, it’s low. For older or lesser-known models, the likelihood climbs much higher, especially if you’re not careful with your electronics in general. You never know when someone might accidentally spill tea on a piece of equipment containing critical systems and data or inadvertently delete important system files, so this threat should be high up on our list no matter what industry we work within. 3. IDENTIFY VULNERABILITIES 3. IDENTIFY VULNERABILITIES Vulnerability is a weakness in your cyber security that allows threats to exploit these gaps to cause harm. Vulnerabilities, just like threats, can come from physical, technical, or human factors. Having incompetent employees is a weakness that can allow a breach in your security through phishing because such employees cannot identify potential threats in emails or websites. The lack of a firewall is a technical vulnerability. Old devices can also be a weakness that allows malicious attacks. Using weak passwords exposes you to potential threats. You can conduct both internal and external checks every three months to identify any weaknesses in your system. Conducting an audit on your system helps you identify vulnerabilities in your assets that can easily be exploited. 4. IDENTIFY RISKS 4. IDENTIFY RISKS Now that you know what a threat and vulnerability are, you need to identify risks. A risk is likelihood that a threat can exploit a weakness and cause harm. While assessing risks that come from within the organization, it’s also crucial to identify risks coming from your vendors’ network. It has become increasingly common to have security breaches coming from third-party networks.