CRISAM® Process model ///

CRISAM® is based on a 6-step process model, also called procedure model. Through a top-down and bottom-up approach, this enables a holistic view of: Strategy, Organization, Process and Infrastructure.

The CRISAM® PROCESS MODEL

This model is the core of the CRISAM® method and offers a high added value in the introduction, update and further development of a risk management system for project managers and decision makers.

Why? It serves as a guideline that you can use to implement your enterprise-wide risk management process. The process model used fulfills the requirements of the international standard ISO 31000 as well as the process steps required by the PDCA Deming cycle.

The CRISAM® process model on an ISMS project example: 

STEP 1 | FRAMEWORK CONDITIONS

• The responsible management derives a risk policy on the basis of the corporate strategy.
• The information security policy provides the framework within which the responsible management is to align IT security.

STEP 2 | SCOPE

• Identification and documentation of possible damages resulting from loss of availability, confidentiality and integrity.
• Result: plausible and comprehensible classification of possible IT-related damages
• Classification based on previously defined threat classes of IT applications
• Derivation of requirements for the company’s IT

Step 3 | Risk analysis

• Assessment of potential threats of loss of availability, confidentiality and integrity of the considered IT applications and data stored and/or processed in them
• Creation of the tree structure of risk sources and qualitative, quantitative or semi-quantitative assessment
• Result: model of the enterprise IT and a rating indicator

Step 4 & 5 | Risk management

• Rating indicator from the risk analysis is weighted and the actual value determined is compared with a target value from the information security policy.
• Analysis of deviations (GAP analysis)
• Result: List of all risk sources & creation of an action catalog

STEP 6 | IMPLEMENTATION OF MEASURES

The catalog of measures drawn up as part of the risk management process is grouped into implementation projects in the final “Implementation” step. The results of this step are project specifications, cost, resource and time estimates, which serve as a basis for decision-making by the responsible management.

Quality and continuity are guaranteed by two test cycles

Advantages

• Continuous improvement through the cyclic flow of the individual process steps
• adjustments due to changes in strategy or technological changes can be carried out quickly

With the implemented test cycles of CRISAM® you simultaneously implement the “Plan-Do-Check-Act” (PDCA) cycle of ISO 31000 required for standard-compliant management systems.

React with your risk management by means of the cascaded control cycles on all three levels:

• technological changes
• changes in threat profiles
• strategic repositioning of the company