risk management

Identifying vulnerabilities in a network and developing a strategy to protect against attack.

The process of managing risks to agency operations (including mission, functions, image, or reputation), agency assets, or individuals resulting from the operation of an information system. It includes risk assessment; cost-benefit analysis; the selection, implementation, and assessment of security controls; and the formal authorization to operate the system. The process considers effectiveness, efficiency, and constraints due to laws, directives, policies, or regulations.

The process, distinct from risk assessment, of weighing policy alternatives, in consultation with all interested parties, considering risk assessment and other factors relevant for the health protection of consumers and for the promotion of fair trade practices, and, if needed, selecting appropriate prevention and control options.

The process of analyzing exposure to risk and determining how to best handle such exposure.

process that ensures that an organization does not assume an unacceptable level of risk; includes both records risk analysis and records risk assessment procedures

[The] Process concerned with the identification, measurement, control, and minimization of security risks in information systems to a level commensurate with the value of the assets protected. [INFOSEC-99]