Information Risk Management

David Sutton's career in IT spans more than 50 years and includes voice and data networking, information security and critical information infrastructure protection. He has been a member of the BCS Professional Certification Information Security Panel since 2005 and has delivered lectures on information risk management and business continuity at the Royal Holloway University of London. He is the author of BCS book 'Cyber Security' and co-author of 'Information Security Management Principles' and 'Data Governance.'

Information risk management is an integral part of every business and the author presents its lifecycle in an easy-to-follow and well-organised format with real-life examples, tools and templates. I highly recommend the book also as a valuable reference for legislation, standards, methodologies and frameworks for risk professionals to follow.

• 1. The need for information risk management2. Review of information security fundamentals3. The information risk management programme 4. Risk identification           5. Threat and vulnerability assessment      6. Risk analysis and risk evaluation               7. Risk treatment 8. Risk reporting and presentation               9. Communication, consultation, monitoring and review   10. The NCSC Certified Certification scheme            11. HMG Security-related documents           12. Appendix A – Taxonomies and descriptions        13. Appendix B – Typical threats and hazards            14. Appendix C – Typical vulnerabilities        15. Appendix D – Information Risk Controls               16. Appendix E – Methodologies, guidelines and tools          17. Appendix F - Templates               18. Appendix G – HMG cyber security guidelines     19. References and further reading