INF30020 Information Systems Risk & Security Management

+91-9519066910

CAD:+1-604-396-3267 ,IN:+91-7503070001, IN:+91-9519066910

Upload Assignment

Home»
Assignment»
INF30020 Information Systems Risk & Security Management

INF30020 Information Systems Risk & Security Management

Rating:

Due: 11:59pm, Friday, 13th October 2017.

Weighting: 20%

Length: Maximum 3000 words (word count does not include your reference lists, appendices, diagrams or tables where these are used appropriately)

Submission procedure:

Electronic submission through Blackboard. More information on the submission procedure including the assignment group cover sheet, and student group assignment declaration will be provided via Blackboard.

Assignment aim:

The risk mitigation report relates to Unit of Study learning objectives 1‐ 5. On completion of the assignment, students should demonstrate an understanding of risk management processes including the role of contingency planning. Students should become familiar with guidelines, literature and approaches to Risk Management in practice.

Assignment tasks:

Your team is to continue in its role as an external consultancy that has been hired by AE Kalina Cycle Senior management to assist the company in risk management. After completing the initial draft of your risk management plan, this second part of the assigned project requires you to create a risk mitigation (RM) plan. Senior management at AEKC allocated funds to support a risk mitigation plan, and have requested that the risk manager and team create a plan in response to the deliverables produced within the earlier phases of the project. The risk mitigation plan should address the threats identified as described in the scenario for this project, as well as any new threats that may have been discovered during the risk assessment. You have been assigned to develop this new plan.

Your risk assessment has identified information assets at AEKC and prioritized the threats and vulnerabilities most likely to jeopardize the information resources that underpin AEKC’s business. Your task now is to plan for that eventuality of risks being realized by preparing a risk mitigation plan. To complete your risk management report, you have been asked to including the business impact analysis (BIA), the business continuity plan (BCP) and a disaster recovery plan (DRP) report with a planned response to those events that are most likely (in your assessment) to disrupt AEKC.

Project: Risk Management Plan – Part 2

For the first part of the assigned project, you created a part of the initial draft of the risk management plan. Therefore, to complete the initial draft, you must:

1. Complete the outline for the completed risk management plan.

2. Update your proposed schedule for the risk management planning process.

3. Identify the key roles and responsibilities of individuals and departments within the organization as they pertain to risk management.

4. Develop a proposed schedule for the risk management planning process.

For the risk mitigation component:

This part of the project is a continuation of Project Part 1 in which you prepared an RA plan for AEKC. Senior management at the company has decided to allocate funds for a business impact analysis (BIA), business continuity management and disaster recovery planning. Because of the importance of risk management to the organization, senior management is committed to and supportive of performing a proper analysis in these areas.

5. Prioritize the most significant risks for AEKC and provides details in a risk assessment table. Then choose the top 5 critical risks.

6. Propose a risk treatment (mitigation and internal control) strategy for the top FIVE (5) critical risks you have identified at AEKC

7. Include the BIA, BCP and DRP plans with the final risk management report.

AEKC’s risk management report needs to be conducted in accordance with best practice and should apply (one, or a hybrid combination of) the leading standards, guidelines or frameworks pertaining to IS risk and security management. Your report must articulate clearly which standards/guidelines it has followed and how they have been used. You are to prepare your risk management report for the company’s senior executive and your report should be written as a formal business report that is suitable for your audience. Guidelines for business report writing can be found at the Faculty of Business and Law, Swinburne subject guide:

http://www.swinburne.edu.au/lib/subjectguide/business‐law.htm

In addition to your use of standards and guidelines for the report, you should research and consult secondary sources in your work and, in presenting your report, follow standard academic referencing procedures for the Harvard Style:

http://www.swinburne.edu.au/lib/studyhelp/referencing.htm

The following should be included with your risk management report:

 A completed group assignment cover sheet (available from Blackboard prior to submission),

 Relevant appendices for the report (should be used as you deem appropriate),

 A report reference list that applies the Harvard style guide (in text citation is an expectation for this report),

 A record of tasks allocated to group members for the assignment and a record (minutes) of the meetings held by the group.

Please note, that the assessment criteria for this report focuses on the analysis and explanation you undertake. For this reason all appendices, tables and diagrams used in the report will not be counted towards the word limit for the assignment. However all diagrams and tables in the report and any appendix added to the report must be relevant, significant and well supported (through written description) in order to count favorably towards your assessment. Appendices, diagrams or tables that have been used simply to

extend the allowable length of the assignment will not be assessed.

Resources to start with may include:

 HB292‐2006 – A Practitioners Guide to Business Continuity Management (available though Swinburne Library Standards Database)

 NIST800‐34 Rev.1 ‐ Contingency Planning Guide for Federal Information Systems (available online)

 I.S. EN ISO 22301:2014 – Societal Security – Business continuity management systems – Requirements (available though Swinburne Library Standards Database)

 Guide to Business Continuity Management: Frequently Asked Questions (Protiviti,

2013),