'risk' (was: Re: Vulnerability Assessment Checklists?

["Meritt James" <meritt_james () bah com>]

Concur in the extreme.  I recommend explicitely differentiating between
Programatic Risk, Business Risk, Information Risk, and Technology Risk. 
They are very different things and I have seen problems arise when
someone is looking for what they have seen in one (not what you have
done, though it has the same title "risk") and not find it.  I spent a
while with the client pinning them down as to their expectations and
recommend that you do the same.

Jim

Muhammad Faisal Rauf Danka wrote:

> Techno-babble, might impress their IT staff, but for the management Business risk is more important than just the 
> Technology risk.


-- 
James W. Meritt CISSP, CISA
Booz | Allen | Hamilton
phone: (410) 684-6566

---------------------------------------------------------------------------
----------------------------------------------------------------------------