The risks of an information system
Risks as seen by the one who steers: families, the four criteria affected, the probability and impact map, four treatments, risk owner and dependence on a supplier.
- 28 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
- Understand
A few cards from the deck
Information system risk: what is it?
Show the answer
A possible event that, if it occurred, would harm the organisation's objectives because of its information set-up; it is described by its probability and impact.
Six families cover it: strategic, project, operational, security, compliance and supplier dependence. Whoever steers must see them all, not only security.
The redevelopment project is six months late because its scope keeps growing. Which risk family does what happened belong to?
- Project risk
- Strategic risk
- Operational risk
- Supplier dependence risk
Show the answer
Project risk
Delay, scope and budget drift are a project's risks. Operations concerns the system in service, dependence a supplier, strategy a wrong choice of direction.
A risk's criticality combines its … and its …; the map places them on two axes.
Show the answer
A risk's criticality combines its probability and its impact; the map places them on two axes.
Neither probability alone nor impact alone ranks a risk: a frequent but minor risk can come after a rare but vital one.
Availability: what is it?
Show the answer
The property of a system being usable when it is needed.
It is hit by an outage, an overload or ransomware blocking access; intact data that cannot be reached is not available.
The vendor triples the subscription price and the company cannot export its data in a format readable elsewhere. What is the cause, and the fix?
- The vendor broke the law; sue to have the price increase cancelled
- The budget was underestimated; provide for the increase next year
- The data is poorly backed up; change backup tool
- Dependence with no reversibility; demand an open export, plan the exit
Show the answer
Dependence with no reversibility; demand an open export, plan the exit
The risk was dependence: without an open export or exit clause, the company has no bargaining power. Paying the increase leaves the lock in place, and backup has nothing to do with format.