HB 167:2006
Security risk management
Outlines a broad framework and the core elements that should be included in a security risk management process, and is consistent with the risk management principles of AS/NZS 4360: 2004. This Handbook can be used by any size or type of organisation - from large multinationals to small businesses, government agencies and the not-for-profit sector.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$243.90 NZD
|
|
| HardCopy |
$271.00 NZD
|
|
| Networkable PDF |
Price varies
|
|
| Online Library ( Annual subscription) |
Info
Price varies
Online Library subscription information Online library subscriptions provide a cost-effective solution for organisations of any size to access the latest standards, offering 24/7 access to a personalised catalogue. The service ensures subscribers have have the most up-to-date version of selected standards, incluing automatic updates for any amendments or versions. Pricing is dependent on the chosen standards and the number of concurrent users, with discounts applied from the standards PDF price. For customised subscriptions or further inquiries, contact the Online Library team. |
HB 167:2006 SECURITY RISK MANAGEMENT
Preface
Contents
1 Introduction
1.1 Security Risk Management—A new paradigm
1.2 Security Risk Management approach
1.2.1 The structure of security risk management
1.3 Security risk management and its relationship with risk management
1.4 Security risk management
2 Communicate and consult
2.1 Introduction
2.1.1 Effective communication
2.2 Engagement
2.2.1 Participation
2.2.2 Engagement and participation of senior management
2.2.3 Engagement and participation of staff
2.2.4 Engagement and participation of other stakeholders
2.3 Perception
2.4 Information transfer
2.5 Decision making
2.6 Developing the communications strategy
3 Establish the context
3.1 Introduction
3.2 The external context
3.3 The internal context
3.4 The security risk management context
3.4.1 Finalising the goals and objectives for security risk management
3.5 Determine the process/program structure
3.6 Developing the evaluation criteria
3.7 Developing the business case
4 Identify risk
4.1 Introduction
4.2 Data and information sources
4.2.1 Retrieving data and information
4.2.2 Potential sources of risk
4.3 Conducting the criticality assessment
4.4 Threat assessment
4.4.1 Identifying the threat
4.4.2 Understanding the threat
4.4.3 Measuring the threat
4.4.4 Likelihood of a security threat
4.5 Conducting the vulnerability analysis
4.5.1 Introduction
4.5.2 Assessing the effectiveness of the controls
4.5.3 Approaches to assessment
4.6 Mapping threat, vulnerability and criticality
5 Analyse risk
5.1 Introduction
5.2 Measuring risk
5.2.1 Consequence
5.2.2 Likelihood
5.2.3 Risk rating
6 Evaluate risk
6.1 Introduction
6.2 Tolerance of risk
7 Treat risk
7.1 Introduction
7.2 Developing a treatment plan
7.2.1 Establish treatment objectives
7.2.2 Identify and develop treatment options
7.2.3 Evaluate treatment objectives
7.2.4 Detailed design
7.2.5 Design review
7.2.6 Communicating and implementing
7.3 Conformance vs. Performance
8 Monitor and review
8.1 Introduction
8.2 The elements of ‘monitor and review’
8.3 Monitoring and review practices
8.4 Triggering monitor and review processes
8.5 Post-event analysis and reporting
Appendix A - Acknowledgments
Appendix B - Definitions and glossary
Appendix C - Security related standards and handbooks
Appendix D - Sources of data and information for establishing the context
Appendix E - Organisational reference sources for establishing the context
Appendix F - Security risk management workbook
F1 Business case template
F2 SRM Project management template
F3 Developing the context template (with some examples)
F4 Information collection worksheet
F5 Criticality and vulnerability assessment worksheet
F6 Threat sources identification and assessment
F7 Threat assessment worksheet
F8 Security risk assessment worksheet
F9 Strategic security risk management activities plan
F10 Security risk management controls assesment checklist
F11 Security survey worksheet
F12 Example treatmen plan template
Appendix G - The Admiralty System
Appendix H - Terrorism definitions
Appendix I - Example vulnerability rating matrices
I1 Visibility rating
I2 Vulnerability: Iconic status
I3 Vulnerability: Threat access
I4 Vulnerability: Collateral exposures
I5 Vulnerability: Interdependency demand
I6 Critical incident management
Appendix J - Example components of a security control environment Physical controls People controls
Appendix K - Community vulnerability assessment
Appendix L - Example questions for use in a vulnerability assessment
Appendix M - Some common approaches to analysing security risk
Appendix N - Key reference sources
Appendix O - URLs for example reference sources for developing the context
Keep me up-to-date
Sign up to receive updates when there are changes to this standard
Related Information
Similar Standards
-
AS/NZS 4183:1994
Value management
-
AS/NZS 5050(Int):2020
Managing disruption-related risk -
AS/NZS IEC 31010:2020
Risk management - Risk assessment techniques -
AS/NZS IEC 31010:2020 A1
Risk management - Risk assessment techniques
HB 167:2006 SECURITY RISK MANAGEMENT
Preface
Contents
1 Introduction
1.1 Security Risk Management—A new paradigm
1.2 Security Risk Management approach
1.2.1 The structure of security risk management
1.3 Security risk management and its relationship with risk management
1.4 Security risk management
2 Communicate and consult
2.1 Introduction
2.1.1 Effective communication
2.2 Engagement
2.2.1 Participation
2.2.2 Engagement and participation of senior management
2.2.3 Engagement and participation of staff
2.2.4 Engagement and participation of other stakeholders
2.3 Perception
2.4 Information transfer
2.5 Decision making
2.6 Developing the communications strategy
3 Establish the context
3.1 Introduction
3.2 The external context
3.3 The internal context
3.4 The security risk management context
3.4.1 Finalising the goals and objectives for security risk management
3.5 Determine the process/program structure
3.6 Developing the evaluation criteria
3.7 Developing the business case
4 Identify risk
4.1 Introduction
4.2 Data and information sources
4.2.1 Retrieving data and information
4.2.2 Potential sources of risk
4.3 Conducting the criticality assessment
4.4 Threat assessment
4.4.1 Identifying the threat
4.4.2 Understanding the threat
4.4.3 Measuring the threat
4.4.4 Likelihood of a security threat
4.5 Conducting the vulnerability analysis
4.5.1 Introduction
4.5.2 Assessing the effectiveness of the controls
4.5.3 Approaches to assessment
4.6 Mapping threat, vulnerability and criticality
5 Analyse risk
5.1 Introduction
5.2 Measuring risk
5.2.1 Consequence
5.2.2 Likelihood
5.2.3 Risk rating
6 Evaluate risk
6.1 Introduction
6.2 Tolerance of risk
7 Treat risk
7.1 Introduction
7.2 Developing a treatment plan
7.2.1 Establish treatment objectives
7.2.2 Identify and develop treatment options
7.2.3 Evaluate treatment objectives
7.2.4 Detailed design
7.2.5 Design review
7.2.6 Communicating and implementing
7.3 Conformance vs. Performance
8 Monitor and review
8.1 Introduction
8.2 The elements of ‘monitor and review’
8.3 Monitoring and review practices
8.4 Triggering monitor and review processes
8.5 Post-event analysis and reporting
Appendix A - Acknowledgments
Appendix B - Definitions and glossary
Appendix C - Security related standards and handbooks
Appendix D - Sources of data and information for establishing the context
Appendix E - Organisational reference sources for establishing the context
Appendix F - Security risk management workbook
F1 Business case template
F2 SRM Project management template
F3 Developing the context template (with some examples)
F4 Information collection worksheet
F5 Criticality and vulnerability assessment worksheet
F6 Threat sources identification and assessment
F7 Threat assessment worksheet
F8 Security risk assessment worksheet
F9 Strategic security risk management activities plan
F10 Security risk management controls assesment checklist
F11 Security survey worksheet
F12 Example treatmen plan template
Appendix G - The Admiralty System
Appendix H - Terrorism definitions
Appendix I - Example vulnerability rating matrices
I1 Visibility rating
I2 Vulnerability: Iconic status
I3 Vulnerability: Threat access
I4 Vulnerability: Collateral exposures
I5 Vulnerability: Interdependency demand
I6 Critical incident management
Appendix J - Example components of a security control environment Physical controls People controls
Appendix K - Community vulnerability assessment
Appendix L - Example questions for use in a vulnerability assessment
Appendix M - Some common approaches to analysing security risk
Appendix N - Key reference sources
Appendix O - URLs for example reference sources for developing the context
HB 167:2006
Online Library subscription information
Online library subscriptions provide a cost-effective solution for organisations of any size to access the latest standards, offering 24/7 access to a personalised catalogue. The service ensures subscribers have have the most up-to-date version of selected standards, incluing automatic updates for any amendments or versions. Pricing is dependent on the chosen standards and the number of concurrent users, with discounts applied from the standards PDF price. For customised subscriptions or further inquiries, contact the Online Library team.