Chapter 14. Information Security Risk Management

Information security risk management is more than simply completing an evaluation. The results of an evaluation provide a direction for improving your organization's security posture. However, the evaluation merely provides a direction; it does not necessarily lead to meaningful improvement. Such improvement occurs only when your organization follows through by implementing the results of the evaluation. This final chapter introduces a framework for managing information security risks.

Section 14.1 Introduction 14.2 A Framework for Managing Information Security Risks 14.3 Implementing Information Security Risk Management 14.4 Summary