A Beginner’s Guide To Choosing A Risk Assessment Framework

A risk assessment framework is an effective approach to understanding and evaluating your organization’s security risks. Using these frameworks will enable you to prioritize your projects better and help align your security goals with existing operational goals and objectives.

However, if you are starting a risk assessment program from scratch, Quill Security has put together a Beginner’s Guide to help you understand how to avoid analysis paralysis and get your new program off the ground fast. Keep reading to know more.

Getting Started

Hire a professional: “Perfect” is often the enemy of “good.” Especially when you are still trying to learn enough to define “good” in the first place. Taking professional advice on where to go can still leave you unsure about the next step. By using a software tool like Quill, you’ll gain confidence with each step, retaining the ability to go back or press on at any point. You’ll never be locked into a final destination (and all the unknown costs that will arise to get there).

Know your scope: How many sites are you assessing, what threats must you cover, how much time do you have, what is your budget?

You need to know what you know: What data sources do you have access to, who can best answer questions about each site’s security maturity and critical assets?

Next Steps

Before choosing a framework, write down the questions your future assessments must answer: These will be your gut check you can return to after learning about all the impressive possibilities.

Commit to an iterative approach: Risk assessments are the first two letters in an OODA (Observe Orient Decide Act) loop. OODA loops work best as a loop! This means that your first pass will be less than you need, by design. And your subsequent loops will be much more effective for it.

Aim for simplicity: The framework you choose will be used by many people who don’t have the expertise and haven’t done the research you are doing now. The framework may even outlive your tenure in this role. It must be simple enough to minimize the possibility of misuse.

Whenever you find a framework or methodology you like, remember to return to your “Questions future risk assessments must answer” and evaluate whether this framework will make those answers clear.

If you are starting from scratch, don’t finish from scratch: Leverage the combined wisdom of the industry to borrow, copy, and purchase the best ideas from the most believable sources. Maintaining your own custom framework is a very expensive proposition.

Advice From The Pros

Don’t fixate on capture and analysis capabilities: The point of a risk assessment, like any loop, is to TAKE ACTION. Your framework will never be participating in that step. You and your people will. You want a framework that helps you O, O, and D quickly and is good enough to take action. The faster the loop, the faster your actions will improve, and the sooner you will become an effective and well-regarded organization.

Make a decision: Do not let the temptation of waiting for “The next great thing” keep you from moving forward now. Risk assessment frameworks are not like smartphones, where you can hold on to your own model until the next version is released. They are more like cellular networks that need constant maintenance and care to stay relevant and useful. If you are avoiding a decision, you are losing ground and delaying the OODA process that improves whichever framework you decide to use. That improvement process won’t start unless you decide.

Use Quill software: If you are starting a risk assessment program for the first time, start by coloring inside the lines. Use a tool like Quill to take your first steps. You will then have the best possible vantage point to decide what needs to be added (or removed) next.

At Quill Security, our goal is to exceed your expectations. As the go-to experts, we are based out of Minneapolis, MN. We provide security risk and threat assessment software to help organizations mitigate RISK and capitalize on OPPORTUNITY. Our services are available to clients across Minneapolis, Bloomington, Hudson Township, Maple Grove, Woodbury, Lakeville, Saint Paul, Brooklyn Center, and the surrounding areas. Visit our website to learn more or contact Quill Security today.