Asset

Information Asset Profile

Do you have an overall view of your organization's information assets in terms of the protection they require for your business to succeed? Can you:

• identify your organization's critical assets?
• identify their owners and custodians?
• determine who depends on these assets and how they are used across your organization?
• classify the security requirements for protecting these assets consistent with your business needs?
• relate these security requirements to your organization's key business issues?

With SSG's Information Asset Profile, you will receive an inventory of your critical information assets that summarizes their security requirements in relationship to your key business issues. This includes ownership of information, classification of information and prioritization of requirements. The deliverable can serve as a communication vehicle between the business functions and the information systems organization because it will explain the requirements for confidentiality, integrity and availability of your critical business information. It can be the starting point for an information architecture and can help establish the business need for maintaining and improving information security controls.

SSG security consultants will conduct interviews with key business and IT managers in your organization to understand what your critical business assets are and the nature and severity of any security risks and exposures to those assets. The risks examined are:

• Confidentiality - the impact to the business if critical information gets into the wrong hands
• Integrity - the impact to the business if the wrong information is used to make decisions
• Availability - the impact to the business if critical information is not available for use when needed.

The final deliverable can be used as a "control book" that highlights which information requires protection, what kind of security is important for the business use of that information, who has ownership responsibility, and how and where the information is primarily used. This enables an information security program to be tailored to provide the right types of controls and mechanisms for the most critical information to the business.

Range of Services

• a comprehensive review of your organization's information assets, their relevance to your key business issues, security threats and requirements, ownership and use
• a final document in the form of an Information Asset Inventory including a profile for each asset (1 per page) containing its description, location, owner, users and usage, availability impacts, confidentiality impacts, and integrity impacts