IT438

The goal of this module is to introduce you to the concept of a critical information asset and to get you to start thinking about the security controls you might assess for a critical information asset.

Organizations typically have lots of physical assets, but not all are critical to the core business of the organization. For example, an office chair is a physical asset. However if the chair were to break or get stolen, it’s doubtful that the impact would be significant. An example of a physical asset that is a little more critical might be an office building. If an organization only had one building and it was destroyed by fire or flood, the impact on the organization would be significant, if not catastrophic.

The same thinking can be applied to information systems. Organizations have several information assets upon which they rely, with some of the information assets being more critical than others. For example, a business that is purely brick and mortar might have a website that is used to provide general information about the business. If that website were to go down, it would have some impact, but it’s doubtful that it would have a critical impact on the business. However if another business is purely online and its website were to go down, the impact would be significant. In the discussion board for this module, you will be generating more examples of a critical information system. You will also be replying to members in your group about the examples they have chosen.

As the critical information assets for an organization are identified, it is also important to determine the appropriate security controls for those assets. Not every control applies to every information asset. Even if a control does apply, the organization’s management may determine that a control is not going to be assessed. One of this module’s questions will ask you to identify five controls that should be assessed for an information asset and to justify why you selected those controls.

As you complete the module’s readings and assignments, one thing to keep in mind is that an information asset is not a computer. The information asset may be stored on a computer, but the computer is NOT the information asset. Step 2 in Introducing Octave Allegro has a good set of definitions that you should refer to.

Critical Information Assets

Initial Post

Realizing that you have yet to conduct your first interview with the manager of the organization you plan to assess, I would like you to list two critical information assets that you think the organization may have. Explain why you chose these to assets and why you think the assets would be critical to the business. I would expect a decent-sized paragraph for each asset.

You should also give a brief overview of the business to give your group members some context.