An IT Risk Assessment Case Study in support of significant technology decision that is to be taken by a fictional company called Aztek that operates in the Australian Financial Services sector.
Senior executives in both business and technology divisions within Aztec have collected a portfolio of projects from their respective strategists that could be potentially funded for deployment. The portfolio includes projects such as.
Allowing employees to bring their own devices (laptops, tablets and mobile phones for example) into the workplace to be used as their main or sole devices in achieving their work tasks Each of these potential projects carries significant IT risks which will need to be managed to support the business case as to whether the project should go forward.
In this case study you are the IT Risk Assessment lead at Aztek, and your role is to be the interface between business stakeholders and technologists, translating potential technical difficulties into risk language to facilitate effective decision-making by stakeholders. Your deliverable for this ITC 596 Case Study is an IT Risk Assessment report, written for the intended audience of Aztek management providing a risk assessment of the project you have selected to consider.
The report must address the following criteria:
An Executive Summary at the beginning of the report which provides a clear statement of the IT technology project that is being assessed, and an overview of your recommendations to Aztek management as to the merits of the project based on your risk assessment.
A review of the project with respect to the Financial Services sector, which would include any relevant government or industry regulation or compliance, and any established best practices
A review of the project impact on the current security posture of Aztec, as expressed by its current maturity against IT Security policies and procedures
A risk assessment based on threats, vulnerabilities and consequences derived from an IT control framework and any existing industry risk recommendations for the project.
For example, there are several consortia for Cloud Computing that have created IT Risk Assessments for this technology . Specially address risks for Data Security from the viewpoint in the project of what data will be used, who will have access to the data and where will the data will flow.