SA/SNZ TR 18128:2015

SA/SNZ TR 18128:2015

COPYRIGHT

PREFACE

CONTENTS

INTRODUCTION

1 Scope

2 Normative references

3 Terms and definitions

3.1 Terms specific to risk

3.2 Terms specific to records

4 Risk assessment criteria for the organization

4.1 Assessment of risk

4.2 Risk criteria

4.3 Assignment of priority

5 Risk identification

5.1 General

5.2 Context: External factors

5.3 Context: Internal factors

5.4 Records systems

5.5 Records processes

6 Analysing identified risks

6.1 General

6.2 Likelihood analysis and probability estimation

7 Evaluating risks

7.1 General

7.2 Evaluating impact of adverse events

7.3 Evaluating the risk

8 Communicating the identified risks

Annex A(informative)Example of a documented risk entry in a risk register

Annex B - Example: checklists for identifying areas of uncertainty

B.1 External factors

B.2 Internal factors

B.3 Records Systems

B.4 Records Processes

Annex C - Guide to using controls from ISO/IEC 27001, Annex A

APPENDIX ZZ - VARIATIONS TO ISO/TR 18128:2014 FOR AUSTRALIA AND NEW ZEALAND

ZZ1 SCOPE

ZZ2 VARIATIONS

ZZ3 VARIATIONS TO INFORMATIVE ANNEXES B AND C

Bibliography

Table

Table 1 — Example of scaling probability

Table 2 — Example of classification of impact assessment of adverse events

Table 3 — Examples of risk evaluation

Figure

Figure 1 — Risk Management process

Figure 2 — The multiple layers of context of an organization’s records and records processes