Determining Your Organization's Risk Management Maturity Level

Before an organization attempts to implement the Microsoft security risk management process, it is important that it examines its level of maturity with regard to security risk management. An organization that has no formal policies or processes relating to security risk management will find it extremely difficult to put all aspects of the process into practice at once. Even organizations with some formal policies and guidelines that most employees follow fairly well may find the process a bit overwhelming. For these reasons, it is important that you make an estimate of your own organization's maturity level. If you find that your organization is still relatively immature, than you may want to introduce the process in incremental stages over several months, perhaps by piloting it in a single business unit until the cycle has been completed several times. Having demonstrated the effectiveness of the Microsoft security risk management process through this pilot program, the Security Risk Management Team could then slowly introduce it to other business units until the entire organization is using it.

How do you determine the maturity level of your organization? As part of Control Objectives for Information and Related Technology (CobiT), the IT Governance Institute (ITGI) includes an IT Governance Maturity Model. You may want to acquire and review CobiT for a detailed method for determining your organization's level of maturity. The Microsoft security risk management process summarizes elements used in CobiT and presents a simplified approach based on models also developed by Microsoft Services. The maturity level definitions presented here are based on the International Standards Organization (ISO) Information technology — Code of practice for information security management, also known as ISO 17799.

You can estimate your organization's level of maturity by comparing it to the definitions presented in the following table.

Level	State	Definition
0	Non-Existent	Policy (or process) is not documented, and previously the organization was unaware of the business risk associated with this risk management. Therefore, there has been no communication on the issue.
1	Ad-Hoc	It is clear that some members of the organization have concluded that risk management has value. However, risk management efforts are performed in an ad-hoc manner. There are no documented processes or policies and the process is not fully repeatable. Overall, risk management projects seem chaotic and uncoordinated, and results are not measured and audited.
2	Repeatable	There is awareness of risk management throughout the organization. The risk management process is repeatable yet immature. The process is not fully documented; however, the activities occur on a regular basis, and the organization is working toward establishing a comprehensive risk management process with senior management involvement. There is no formal training or communication on risk management; responsibility for implementation is left to individual employees.
3	Defined Process	The organization has made a formal decision to adopt risk management wholeheartedly in order to drive its information security program. A baseline process has been developed in which there are clearly defined goals with documented processes for achieving and measuring success. Additionally, some rudimentary risk management training is available for all staff. Finally, the organization is actively implementing its documented risk management processes.
4	Managed	There is a thorough understanding of risk management at all levels of the organization. Risk management procedures exist, the process is well defined, awareness is broadly communicated, rigorous training is available, and some initial forms of measurement are in place to determine effectiveness. Sufficient resources have been committed to the risk management program, many parts of the organization are enjoying its benefits, and the Security Risk Management Team is able to continuously improve its processes and tools. There is some use of technological tools to help with risk management, but many if not most risk assessment, control identification, and cost-benefit analysis procedures are manual.
5	Optimized	The organization has committed significant resources to security risk management, and staff members are looking toward the future trying to ascertain what the issues and solutions will be in the months and years ahead. The risk management process is well understood and significantly automated through the use of tools (either developed in-house or acquired from independent software vendors). The root cause of all security issues is identified, and suitable actions are taken to minimize the risk of repetition. Training across a range of levels of expertise is available to staff.

Organizational Risk Management Maturity Level Self Assessment

The following list of questions offers a more rigorous way to measure your organizational maturity level. The questions elicit subjective answers, but by honestly considering each of them you should be able to determine how well prepared your organization is for implementation of the Microsoft security risk management process. Score your organization on a scale of 0 to 5, using the previous maturity level definitions as a guide.

Calculate your organization's score by adding the scores of all of the previous items. Theoretically, scores could range from 0 to 85; however, few organizations will approach either extreme.

A score of 51 or above suggests that the organization is well prepared to introduce and use the Microsoft security risk management process to its fullest extent. A score of 34 to 50 indicates that the organization has taken many significant steps to control security risks and is ready to gradually introduce the process. Organizations in this range should consider rolling out the process to a few business units over a few months before exposing the entire organization to the process. Organizations scoring below 34 should consider starting very slowly with the Microsoft security risk management process by creating the core Security Risk Management Team and applying the process to a single business unit for the first few months. After such organizations demonstrate the value of the process by using it to successfully reduce risks for that business unit, they should expand it to two or three additional business units as feasible. Continue to move slowly, though, because the changes introduced by the process can be significant. You do not want to disrupt the organization to such a degree that you interfere with its ability to effectively achieve its mission. Use your best judgment in this regard — every system that you leave unprotected is a potential security and liability risk, and your own knowledge of your own systems is best. If you think that it is urgent to move quickly and to disregard the suggestion to move slowly, do that.

You should carefully consider which business unit to use for the pilot programs. Questions to consider relate to how important security is to that business unit, where security is defined in terms of the availability, integrity, and confidentiality of information and services. Examples include:

You should consider these same questions when selecting business units for expansion of the program.

MCSE Boot Camp

Determining Your Organization's Risk Management Maturity Level

Organizational Risk Management Maturity Level Self Assessment