Risk Assessment

 complete both the risk assessment plan document and the risk assessment checklist (note: for the checklist you can type over the sample items to create a unique list of your own, and then you’ll need to assign a number for each item.  DO NOT REUSE THE ITEMS THAT ARE THERE, those are only a sample).

Risk

Assessment Checklist

Risk Assessment Checklist

Risk

1

3

5

7

9

1 1

3 1

5 3

7

9

1 3

3 3

s leave before the project completion

5 6

7 6

9 9

1 1

3 1

5 1

7 1

9 1

1 9

3 3

5 5

7 7

Contractor

9 9

1 1

3 3

5 5

7 7

9 9

1 1

3 3

5 5

7 7

9 9

1 1

3 3

5 5

7 7

Category

Impact

Likelihood

Difficulty of Detection

Organizational

Project lacks Executive-level Sponsor

1

Budget reduces team’s capacity

3

Management insist on decisions that lengthen schedule

5

Inefficient team structure reduces productivity

7

Review/decision cycle slower than expected

9

Vendor tasks take longer than expected

Staff

Hiring resources takes longer than expected

Work from a prior project not be completed on time

Low motivation reduces productivity

4

Lack of skills increases defects

6

Personnel with critical skills unavailable

Personnel need extra time to learn unfamiliar tools

Contractor

Conflicts between team result in errors and extra rework

Development Environment

Facilities not be available on time

Facilities inadequate

Development tools may not be in place by the desired time

Development tools may not work as expected

Learning curve for new tools longer than expected

User

User requirements are unstable

User review/decision cycles slower than expected

Users may not participate in review cycles

Users may not accept the end product

Users may have expectations than cannot be met

Contractor may not deliver work when promised

Contractor may deliver low quality products

Contractor may have other high-priority work

External

Product depends on government regulations

Product depends on draft technical standards

Specifications poorly defined

Additional requirements added

Error-prone modules may require more testing

Components may not be easily integrated

Schedule

Schedule, resources, and product definition unclear

Schedule is over-optimistic

Schedule omits necessary tasks

Excessive schedule pressure may reduce productivity

Schedule includes several tasks that have multiple predecessors

Schedule includes milestones that have not been clearly defined

ISOL 533 – Information Security and Risk Management Risk ASSessment Plan
University of the Cumberlands

Executive Summary

Risks – threats – weaknesses within each domain

“1” is Critical: an R-T-W that impacts compliance and places the organization in a position of increased liability.

“2” is Major: an R-T-W that impacts the C-I-A of an organization’s intellectual property assets and IT infrastructure.

“3” is Minor: an R-T-W that can impact user or employee productivity or availability of the IT infrastructure

Copy the R-T-W from your ‘Part-I Task-1’ Risk Management Plan and update it to address the Risk Impact/Factors from the table>

Compliance Laws and Regulations

< Copy your Compliance Laws and Regulations from your ‘Part-I Task-1’ Risk Management Plan >

R-T-W

Domain Impacted

Risk Impact / Factor

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Risk
:
Threat
:
Weakness
:

Table 1

Figure 1