Reference no: EM134046234
ASSIGNMENT:
Competency
In this project, you will demonstrate your mastery of the following competencies:
- Analyze the design of a risk mitigation plan for its inclusion of best practices in the field
- Identify legal and ethical considerations in risk analysis and mitigation within an information technology environment
Scenario
You are a risk management consultant and have been contacted by the chief information officer (CIO) of Workers Werks Credit Union (WWCU), a mid-size but growing credit union, to conduct an evaluation of its current IT cybersecurity risk management plan. Data privacy is a big concern in the banking sectors, and the CIO is concerned that WWCU's current plan is outdated and has significant weaknesses.
In your conversation with the CIO, you gather the following information about the situation:
Current plan: The credit union adopted the current cybersecurity risk plan three years ago, but the CIO is concerned about possible gaps in the plan and would like to update it.
Workforce: The credit union has experienced significant revenue growth, and the number of employees with access to its IT infrastructure has grown exponentially in the last five years.
WWCU now has nearly 1,000 users with different levels of access to its central database.
Strategy: The credit union is looking to expand into new markets in the coming year and will need to make significant changes to its IT infrastructure.
Compliance: The CIO is concerned not only about legal compliance but also ethical issues related to the protection of personally identifiable information (PII) of its customers. The company has set these priorities related to legal and ethical compliance:
- Address the current legal environment (domestic and international)
- Anticipate emerging issues
- Meet industry ethical standards (e.g., SANS IT code of ethics)
- Match best practices for risk planning within the industry
Directions
Risk Analysis Report
The CIO is asking you to prepar report that evaluates the company's current IT Security Risk Management Plan, linked in the Supporting Materials section.
The report should contain the following:
1. Scope: Evaluate the scope and comprehensiveness of the current plan.
- How does the plan describe its objectives?
- How does the plan balance risk and cost?
- In what ways does the plan cover the business objectives end to end?
- How does the plan address all stakeholders who could be impacted by a cybersecurity attack?
2. Risk: Determine how the current plan identifies risks.
- How does the plan identify the risks, vulnerabilities, and threats that could impact mission-critical business functions and processes?
- How does the plan identify industry-related risks (internal and external)?
3. Impact: Analyze how the identified risks might impact the organization's assets.
- How does the plan identify key assets and activities that need to be protected?
- How does the plan estimate the financial impact of losses?
- How does the plan address business continuity and asset replacement?
- Mitigation: Evaluate the current plan's mitigation recommendations.
- How effectively does the plan translate the risk assessment into a risk mitigation plan?
- How does the plan prioritize risk elements?
4. Legal Compliance: Assess how the plan addresses legal considerations.
5. Non-Compliance: Determine how the plan anticipates the implications of non-compliance.
6. Ethical Considerations: Assess how the plan aligns with current ethical codes within the cybersecurity field.