Practical Risk Management for the CIO

Detailing procedures that will help your team perform better risk assessments and aggregate results into more meaningful metrics, Practical Risk Management for the CIO approaches information risk management through improvements to information management and information security. It provides easy-to-follow guidance on how to effectively manage the flow of information and incorporate both service delivery and reliability. Clarifying common misunderstandings about the risks in cyberspace, this book provides the foundation required to make more informed decisions and effectively manage, protect, and deliver information to your organization and its constituents.

Table of Contents:
Introduction: Why Risk Management? Liability. Service Delivery. PRINCIPLES AND CONCEPTS. Overview. Basic Concepts, Principles, and Practices. Risk Assessment, Analysis, and Procedures. Metrics. Best Practices. SERVICE DELIVERY. Product Management. Process Management. Project Management. IT Service Management. Reporting on Service Delivery. LIABILITIES MANAGEMENT. Information Management. Information Protection. E-Discovery. Privacy. Policies and Procedures. Planning for Big Failures or Business Continuity. PUTTING IT ALL TOGETHER. Designing a Risk Management Strategy. Forward-Looking Risk Management. Preparing for a "Black Swan". APPENDICES: OECD Privacy Principles. Project Profiling Risk Assessment. Risk Impact Scales. Classification Schema.

About the Author :
Mark Scherling, CISSP, CRM, has been working in IT for over 30 years. For the past four years, he has been managing information security and privacy for the Justice Sector in the Government of British Columbia (Canada). Prior to the Justice Sector, he managed the Information Security Investigations Unit for the entire BC government. He has designed and implemented public key infrastructure (PKI) and security solutions for numerous clients. He is considered a Subject Matter Expert in Risk Management and Information Security by the Information Systems Audit and Control Association (ISACA). He contributed to the Risk IT Framework and Certification in Risk and Information Systems (CRISC), a new ISACA Certification. He is viewed as a Security and Risk Management Expert by many people within and associated with the Government of British Columbia. His background includes sales, marketing, and information management. In the mid-1990s, he was instrumental in developing and implementing the Canadian Department of National Defence Intranet or the DIN. He has significant experience in information and knowledge management. He combines this expertise with information protection to create an information risk management strategy for Chief Information Officers (CIOs). He has been part of the evolution of information technology (IT) from Digital Equipment's Vaxes and PDP11s to mobile computing, the Internet, and cloud computing. The interconnected world we now live in holds exciting promise to link people, computers, applications, and information. There are risks when we link everything together and share information. Organizations are always trying to reduce costs and improve customer relations. Mark has been involved in information security for over 13 years and has oriented his approach from simple information security to risk management strategies. As the Internet continues to evolve, so evolves information se

Review :
This is an exceptionally well-written primer for anyone responsible for corporate information risk management. ... It's obvious that the author has regularly encountered and solved the problems he describes in the course of his three decades in Canadian government and justice IT, and he has an appealing no-nonsense approach. ...the true greatest strength of this book is its holistic viewpoint - all too rare and much appreciated - that demonstrates how all the disparate aspects of information management actually fit together to create a robust business asset base. I can unhesitatingly recommend it, not only to CIOs but also to anyone tasked with protecting corporate information assets, whatever the level of their role. It imparts understanding, which is vastly more useful than mere facts. An excellent holistic primer on corporate information management. The author's credentials are fully justified by the clear, concise and informative text. A must-have for CIOs and anyone else managing business information assets. -Michael Barwise, BSc, CEng, CITP, MBCS, in InfoSec Reviews, September 2011