Re: Re: Information Risk Management

Alan,

thank you for your advice regarding the ISF standard. I'd like to note here 
that the references in this standard are to risk analysis and not risk 
management - and the two are not synonymous.

Thanks to all the people who sent me pointers to various sites and papers.

To clarify my first comment in this post, I'd like to ask one more time for 
help but to be precise about what I need. To that end, let me try a little 
definition: If risk analysis is a process to identify and prioritize risks, 
risk management is an overall effort to manage risk to an acceptable level. In 
other words, risk management establishes the context, identifies and analyzes 
risks, evaluates and selects controls, implements controls, measures their 
effectiveness and communicates results to the leaders of an organization.

Having said all that, if there's anyone out there who can talk to me about how 
'risk management' has been successfully implemented at their organization, I'd 
be grateful.

John A Blackley