Risk Management Policy
By: Luis Martinez

I was just hired as the Information Security Engineer for IDT, Inc. due to the multiple security breaches which has threatened its customer’s vital and sensitive data. There has also been suspicious activities going on during business hours and at times after hours. There are several items I will be incorporating into the policy. *The first step will be to revise, identify and classify the business IT assets down to which servers hold sensitive and confidential information. But, to determine which IT assets are most important, I need to first understand the core issues and concerns of the business. Certain risks that should be considered include: Data Confidentiality - The risk that confidential or sensitive information may be mishandled or made available to those who shouldn’t have access to the data. In many regions, protection of sensitive information is required by law and is also addressed on an industry-by industry basis through organizations such as the PCI Standards Council. Data Integrity Risk - This is incurred when the underlying data is unreliable because it is incomplete, inaccurate or otherwise suspect. The cause could be deliberate tampering or simple human error, be it improper error checking on form submissions or the inappropriate configuration of a transaction server. Regardless of the cause, the impact to the business can be considerable, especially if the erroneous data is not discovered for some time. One of the most well-known IT risks in an organization is availability. The short term loss of service due to IT systems failure has the potential to have a significant - and potentially long-lasting - impact on the daily operations of a business. Relevance Risk - This type of risk is rarely considered, but is one of the most common types we face. It has to do with not getting the right information