Re: Information Risk Management

John, thanks for your clarification -- I read the original post too 
quickly.
The ISF does have substantial research reports and a tool call Fundamental 
Information Risk Managment (FIRM), as well as a current project on 
methodologies and tools, but it's available only to ISF Members 
(plug,plug).
As far as the Standard of Good Practice goes, IRM is addressed somewhat in 
the sections I cited before, but you are correcting in that they primarily 
address information risk analysis/assessment.
Section SM72 addresses high-level security monitoring, which may be 
helpful. Otherwise, information risk management specifications are spread 
across various areas. For example, Section SM66 deals with electronic 
commerice, but has some details on how risks from e-commerce initiatives 
are to be managed.
-- Alan
"The views expressed here are mine and do not reflect the official opinion 
of my employer or the organization through which the Internet was 
accessed."