Risk Management Maturity
Assessing risk begins with baselining, establishing a current state to get to the desired state. Progress is measured by meeting milestones and objectives, i.e. a maturing process. For example, the capability maturity model has the following framework:
- Initial – informal
- Documented Strategy & Principles – formalizing
- Adaptive Security Architecture – well defined
- Security Organization & Roadmap – optimized
- Baseline Security Standards – quantitatively controlled
Give examples of risk at the level of these categories and how each level mitigates risks from the previous level?