Lab #4 - Assessment Worksheet
Performing a Qualitative Risk Assessment for an IT Infrastructure Course Name and Number: CYBS 221 1001
Student Name: Kendall Watson Instructor Name: Dave Anderson Lab Due Date: September 20, 2015 at 11:59pm
Overview
In this lab, you defined the purpose of an IT risk assessment, you aligned identified risks, threats, and vulnerabilities to an IT risk assessment that encompasses the seven domains of a typical IT infrastructure, you classified the risks, threats, and vulnerabilities, and you prioritized them. Finally, you wrote an executive summary that addresses the risk assessment findings, risk assessment impact, and recommendations to remediate areas of noncompliance.
Lab Assessment Questions & Answers 1. What is an IT risk assessment's goal or objective?
Click here to enter text. The goal is to define how the risk to the system will be managed, controlled, and monitored. 2. Why is it difficult to conduct a quantitative risk assessment for an IT infrastructure?
A qualitative assessment is based on opinion than actual fact, and IT risk assessments need to be based on a quantitative analysis. 3. What was your rationale in assigning a "1" risk impact/risk factor value of "Critical" to an identified risk, threat, or vulnerability?
The critical needs to be mitigated immediately.

4. After you had assigned the "1," "2," and "3" risk impact/risk factor values to the identified risks, threats, and vulnerabilities, how did you prioritize the "1," "2," and "3" risk elements? What would you say to executive management about your final recommended prioritization?
By assessing how important the risk is to the infrastructure and how quickly the risk needs to be mitigated. The one’s and two’s need to be mitigated as soon as possible and the three’s can be mitigated or left alone at managements decision.