Risk Assessments

There are two primary reasons for the growing interest in, and need for, a Risk Assessment. The first is the rapidly-growing number of threats such as viruses, Trojan horses, and hackers that target organizations of all sizes. The second is the fact that businesses today rely extensively on their IT environments to meet their business goals.

IT systems face inherent risks, no matter the size of the environment. These inherent risks must be mitigated, but knowing where to focus can be a challenge. Risk Assessments assist in defining the current security conditions so that IT management can make informed decisions and appropriate investments. Risk-based decisions are the basis of almost every compliance standard.

Designing and implementing a security plan that provides the appropriate controls to respond to threats, while ensuring the most effective use of budgets and resources is often extremely demanding. Understanding the people, processes, and technology that interact with sensitive and mission-critical information provides an essential baseline understanding and foundation. From here IT management can define the controls over IT resources and apply them within the context of the business owners’ roles and responsibilities.

TrustNet provides Risk Assessment services using a combination of automated tools, that collect technical risk information, and our expert consulting and investigative services. When properly analyzed and correlated the technical and investigative results are translated into actionable recommendations that ensure security and compliance goals are achieved.

TrustNet Strategy

We use a variety of techniques to gather information, some of which we pioneered within the IT security industry.

• Questionnaires and surveys delivered via email and web
• On-site investigative interviews and assessments
• Document Review - Policy and procedures documents, system documentation, system design and requirement document, acquisition document, and security-related documentation (e.g., previous audit report, risk assessment report, system test results, system security plans)
• Risk Assessment Tools - We use both commercially available and proprietary automated tools to collect relevant data, securely and confidentially.

How TrustNet Helps

TrustNet provides information security policies and procedures leveraging our consultants' decades of experience and a vast database of best-practice policies and procedures. We customize these to suit each client's unique needs and provide hands-on guidance in communicating these policies across the organization.

• Affordable - designed and priced to meet your specific needs no matter how small or large your requirements
• Comprehensive - provides a complete set of policies and procedures to meet a wide variety of compliance and security objectives including CobIT, SOX, PCI, and HIPAA.
• Fast – using a combination of automated tools and investigative consulting we provide rapid results
• Effective – we provide actionable data and recommendations with detailed step-by-step guidance
• Proactive - identifies potential issues in security policies and procedures before they impact the business

TrustNet Risk Assessment Approach