top of page
Image (7).png

IT Risk Assessment 

IT risk is a major concern for any organization, public or private. Protecting data, reputation, and your bottom line requires a dynamic, sustainable IT risk management strategy. Without effective risk management, security vulnerabilities, compliance gaps, and operational deficiencies will go unchecked, inevitably resulting in poor technology and business performance. Additionally, a lack of good risk management practices can open the door for cyber criminals to exploit critical systems and data. 

How We Can Help

Securance offers two categories of IT risk assessments:

Framework-based risk assessment
In a framework-based risk assessment, Securance reviews the IT organization, its processes, and technologies against an organizations’s preferred risk management, security, or control framework; examples include:
 

  • National Institute of Standards and Technology (NIST) Special Publications (SP) 800-30 and 800-53

  • Control Objectives for Information Technology (COBIT)

  • Center for Internet Security (CIS) Controls

  • International Standards Organization (ISO) 27001 and 27002

​

We also take legal and regulatory compliance obligations into account when performing these risk assessments. Our process includes identifying threat sources, vulnerabilities, and threat-vulnerability pairs; determining the likelihood and impact of each threat-vulnerability pair; using our likelihood and impact determinations to calculate risk; and developing customized recommendations to reduce risks to an acceptable level.

SCGRC Risk Assessment
Securance uses an internally developed risk assessment tool, SCGRC, to quantify risks across the IT environment, generate an IT risk matrix, and develop a multi-year IT audit plan.​

SCGRC is a web-based risk assessment application that identifies information security risks affecting auditable technologies and IT processes. Auditable technologies include enterprise applications, databases, operating systems, cloud services, security tools, and network devices. Securance works with clients to select risk categories that fit their technology profiles, security and compliance concerns, and objectives for the project. These risk categories are used to operationally define risk and populate the assessment questionnaire. Examples of risk categories include: 

IT Risk Assessment Data Sheet

558

We can help!

  • Would a loss of data lead to financial exposure? 

  • Is the technology internally developed or commercial-off-the-shelf (COTS)? 

  • Is the technology heavily customized, or is it a “vanilla install”?

  • Have recent changes been made to the technology?

  • Is the technology nearing end-of-life or scheduled for replacement? 

Once risk categories have been selected, Securance helps IT and business staff members to complete the questionnaire for each technology they administer and | or manage. SCGRC analyzes the interview data for evidence of risks across the environment. Our consultants use the results to customize a three-year IT audit plan that focuses future efforts and investments on the right technologies.  

THE SECURANCE DIFFERENCE

Executive-level consultants provide hands-on leadership to ensure every project is a success.

Senior resources with 20 or more years of experience don’t just lead engagements; they execute them from cradle to grave.

Icon (4).png

We speak two languages, business and IT, and use our fluency to translate technical findings into business risks.

Our reports and recommendations are in plain English, not IT jargon, that all stakeholders can understand and appreciate.

Icon (5).png

Securance is the only IT security firm that uses artificial intelligence to enhance its approach to identifying risks and vulnerabilities.

Our proprietary AI technology predicts security and control failures, compliance gaps, and even data breaches.

Icon (6).png
bottom of page