How FSOs Develop a Risk Assessment Model to Protect Classified information
I’ve posted a few articles on risk assessment and using the risk assessment results to implement and direct a security program to protect classified information. I’ve even written about how risk assessment can help you determine whether or not you need alarms, cameras and other protective measures above what may be required of the NISPOM . However, what I have not written about is how to do a risk assessment. You might recall in earlier articles that I’ve emphasized the importance of finding out what the threats to classified information are to your particular organization. One of my concerns is that a lot of FSOs may financially commit their companies to expensive endeavors that may not even be required. Industry standards and common practices may almost seem like requirements. To some, it may be unheard of not to have alarms, cameras or access control systems (door magnets and card readers). However, these are not required in NISPOM (except for intrusion detection systems as identi...