Risk Management

In late 2005, the Security Review Policy was adopted by the University, which states "Where appropriate, information security personnel will conduct risk assessments of technologies/processes that are being evaluated and/or used at Georgia State University. The purpose of these assessments is to quantify the impact and probability of potential threats and vulnerabilities.

In this session, we will address the current cybersecurity issues that are challenging higher education leaders today as they try to stay on top of the risks associated with attacks on information systems from internal and external sources. Emerging enterprise risk management (ERM) methodologies will be examined as a source of guidance for creating an effective risk-based approach for managing current and future threats.

In 2005, the University of Notre Dame suffered a serious incident that brought information security into the campus spotlight. In response, we partnered with a Big Four consulting firm to conduct a comprehensive IT risk assessment. Two years later, we're halfway through a four-year risk management program.

This research bulletin presents a methodology, used successfully at the University of Technology, Sydney (UTS) in Australia, for managing and assessing risks related to information technology systems and resources. It describes the institutional commitment, background, organizational structure, methodology, implementation, and outcomes of an institutionally inclusive risk assessment that yielded valuable results that can be applied in other colleges and universities.

Citation for this work : Waters, Ian. “Managing IT Risk in Higher Education: A Methodology” (Research Bulletin, Issue 6). Boulder, CO: EDUCAUSE Center for Applied Research, 2008, available from http://www.educause.edu/ecar.

The purpose of this policy template is to ensure that risks to University information are identified, analyzed, and managed so that they are maintained at acceptable levels. Risks to the confidentiality, integrity, and availability of university information are considered.

The Risk Assessment Consultants List is intended as an aid to schools seeking a place to start looking for risk assessment vendors. It provides links to referencing institutions which may be able to provide additional information regarding specific consulting engagements. Note: The only way a vendor can get onto this list is to be placed there by an EDUCAUSE member institution that has engaged the consultant.

The Security Task Force Risk Assessment Working Group has developed this list of Risk Assessment tools which can aid with a risk assessment. The tools are a mix of some sold or licensed by vendors, some provided by colleague institutions, and some from associations or standards groups. This list does not contain any comparative or value judgment information regarding the tools. It merely provides the list as a starting point for the product-seeking process.