IT Infrastructure Risk Assessment Checklists/Programs for IT Assurance Practitioners

Risk assessments are carried out primarily to identify risks/vulnerabilities inherent in an organization's business operations, information systems and IT infrastructures, estimate their likelihood of occurrence, determine impact of such risks to the organization and prioritize risks based on their critically, likelihood of occurrence and availability of resources to address them.

Risk assessment revolves around these three factors: Value organizations attach to their assets at risk, Criticality/severity of the threat, and extent of exposure of systems to identified threats. Using these factors, one can assess risk and likelihood of occurrence as well as potential loss (in terms of monetary value) to an organization. Risk can be represented in the following formula:

Risk = Probability of losses * Value at Risk(asset at risk)

Risk = Likelihood of Occurrence * Value at Risk

Where asset at risk is of no value to an organization despite threat and likelihood of occurrence being high or significant, the risk remain zero/low/insignificant given that anything multiplied by zero or value tending to zero is zero/insignificant. To successfully conduct risk assessment, gathering the required level of information about assets in scope of such assessment is imperative to determining what exposure an organization is facing. As such, the assessment team could adopt the following methods/steps in gathering required information.

Interview stakeholders, management, process/business/data owners, users and other employees in scope of such assessment
Analyze relevant systems and infrastructures
Perform vulnerability assessment and penetration testing (VAPT)
Review relevant documentations such as policies, procedures, previous audit/assessment reports, external audit or regulatory assurance reports, etc.

To perform risk assessment,the following steps can be adopted:

Identify vulnerabilities inherent in the system and threats that could exploit those vulnerabilities.
Identify threat agents or threat actors (i.e. individuals, groups or agents that could exploit vulnerabilities within a system).
Identify valuable assets across the organization that could be exploited by threats in which monetary values could be lost. for example, servers, network equipment, applications, confidential information, transaction data, documents.
Identify potential impact to the organization in the event that identified vulnerabilities are exploited. such impact could be data loss, reputational damage, litigation, financial loss, unauthorized access, regulatory sanction, etc.
Estimate likelihood of occurrence of identified risks/threats/vulnerabilities. For example, system failure, malicious attacks, natural disasters.

Having established the right foundations for risk assessment above, it is important for information assurance practitioners (IT Risk Manager, Information Systems Auditor, Information/Cyber Security Analysts, Information Systems Control Analysts, among others) to have the required skill sets to effectively carry out such assessment exercise. Hence the need to develop the under-listed risk assessment checklists/program to assist practitioners be on top of their assurance activities.

To fill the identified skill gaps in the industry, we are providing IT Assurance practitioners with robust, in-depth risk assessment checklist/templates that will help them understand or be aware of some of the critical risks/vulnerabilities inherent in their operating environment and threats that could exploit those vulnerabilities for effective dimensioning of risk and conducting of risk based audits and information security assessment programs. Being aware of challenges being faced by IT assurance practitioners in the areas of skill gaps and identification of their audit universe, we came up with this IT infrastructure risk register and assessment checklists that capture general vulnerabilities/risks peculiar with widely deployed IT infrastructures and supporting processes to awaken their alertness to be alive to their responsibilities.

To access the highlighted risk assessment checklists below, you can subscribe to our membership package, which gives you access to download the risk assessment checklists/programs including contents only available to members.

The risk assessment checklists/programs will guide users in performing in-depth risk assessment of their IT infrastructure, establish a risk-based audit and information security assessment programs. This checklists can easily be integrated into templates of popular audit management software such as teammatessolutions or MKinsight in the required formats. Below are three difference categories of membership.

Silver Class: $75 subscription fee for 3 months membership

3 Months Subscription(silver)

Gold Class: $100 subscription fee for 6 months membership

6 Months Subscription(silver)

Platinum Class: $150 subscription fee for 12 months membership (Premium)

12 Months Subscription(silver)

Note: Each class of membership subscription gives you access to the under-listed risk assessment checklists/programs. However, Platinum/VIP subscription gives you FULL access to all content in our website including the under-listed risk assessment checklists/programs as well as premium content such as eBooks, IT audit programs/checklists, best practice guides, etc., Gold subscription give you access to the risk assessment checklists/programs with restricted access to some premium content on our website. Silver membership class only gives you access available risk assessment checklists/programs listed below. By purchasing any of our paid services (subscription based access, single document purchase or reseller rights) or accessing any other materials/documents freely available on this website, you commit that you have read and understood our Terms and Conditions of Service and expressly agree to the provisions of the terms and conditions stated therein.

Below are the available risk assessment checklists/programs