Information Risk Management

David Sutton's career in IT spans more than 50 years and includes voice and data networking, information security and critical information infrastructure protection. He has been a member of the BCS Professional Certification Information Security Panel since 2005 and has delivered lectures on information risk management and business continuity at the Royal Holloway University of London. He is the author of BCS book 'Cyber Security' and co-author of 'Information Security Management Principles' and 'Data Governance.'

1. The need for information risk management


2. Review of information security fundamentals


3. The information risk management programme 


4. Risk identification           


5. Threat and vulnerability assessment      


6. Risk analysis and risk evaluation               


7. Risk treatment 


8. Risk reporting and presentation               


9. Communication, consultation, monitoring and review   


10. The NCSC Certified Certification scheme            


11. HMG Security-related documents           


12. Appendix A – Taxonomies and descriptions        


13. Appendix B – Typical threats and hazards            


14. Appendix C – Typical vulnerabilities        


15. Appendix D – Information Risk Controls               


16. Appendix E – Methodologies, guidelines and tools          


17. Appendix F - Templates               


18. Appendix G – HMG cyber security guidelines     


19. References and further reading