IT Risk Assessment and Mitigation for ABC Fitness Gym

Topic
Name of the Student:
Student ID:
Subject Code:
Subject Code:
Subject Name:
Assessment Item Number and Name:
Lecturer Name:

Subject Code Subject Name Semester Number
Table of Contents
Executive summery.................................................................................................................................................2
Risk assessment.......................................................................................................................................................2
The threats related to the IT control framework:.................................................................................................2
Consequences of the threats:...............................................................................................................................3
Risk mitigation.....................................................................................................................................................4
Risk register.........................................................................................................................................................4
Risk Matrix..........................................................................................................................................................8
Protection mechanism..............................................................................................................................................8
Conclusion and Recommendation...........................................................................................................................9
Reference...............................................................................................................................................................10

Subject Code Subject Name Semester Number
Executive summery
In 1997, the owner of ABC Fitness gym started this gym and it acquired a small area in the beginning. It
used to have 20 members in the overall gym and gradually they expanded their premises that contains 50
employees who are working full time and 150 employee those are working for part-time. Subscription plans for
members are initiated and it is revised every year. The gym contains two types of equipment one for weight
machine and other one is of cardiovascular machine. The company aims to provide several services related to
information system such as, automated membership renewal, maintenance of the equipment, updating the
equipment to their latest features, maintenance of the details of the employees with highest confidentiality.
Routine backup of data, use of updated software and hardware.
The recommendation to the management of the gym is to introduce latest devices into the system in
order to maintain details of employees, prevention of the information system department. Recruitment of IT
experts in the gym will benefit the company the most as they can keep track of all the malicious attack into the
IT system as well as IT related malfunction to the equipment (Peute et al., 2014). The data storage system of the
company is a vital part as it contains all the details of the employees, members and stakeholders along with
company details, therefore specific software and experts must be assigned in order to protect that.
Risk assessment
The ABC fitness gym consists of several employees and members are categories in two groups. The
equipment in the gym are of two type one is of weight machines and other one is cardiovascular machines all
the equipment have Information technological functionalities. For the new company several IT framework-
based systems are introduced such as automated membership renewal process, keeping track of the health of the
members of the gym, maintenance of the client details in the IT system, updating software and hardware for
data storage, backup of data, secured computer systems (Koehler et al., 2014).

Subject Code Subject Name Semester Number
The threats related to the IT control framework:
 Failure of software and hardware- The software and hardware which are maintain the data of the
organisation may fail due to malicious attacks (Arulraj et al., 2014).
 Failure of data backup- The data backup process can be stopped due to system failure or unwanted
malware attacks.
 Security of the information- The details related to the employees and members must be secure inside the
system of the organisation.
 Confidentiality of client details- The details of the clients such as organisation that have membership of
the gym must be well secure (Pattenden & Sheehan, 2016).
 Functionality of gym equipment- The gym equipment must be maintained so that the functionality run
smoothly.
 Human mishandling of IT system- The members, employees, and other clients may not know all the
functionalities of the equipment or IT system of the gym (Omar et al.,2017). Therefore, inadequate
knowledge of the advanced system may lead to mishandling of the system.
 Inadequate IT experts- The unavailability of the IT expert in the company will increase the IT threats
more (Ammenwerth et al., 2014). The system will become more vulnerable to attacks.
Consequences of the threats:
The consequences of the above can be vast, the consequences of the threats are identified by analysing
them properly. The failure of hardware may lead to repurchase of cuter system into the business and the softer
failure may cause due to malicious attacks that may result in data breach, loss of data, data manipulation ( Sen
& Borle, 2015). The consequence of data backup failure will lead to loss of data, that may affect the database of
the company that contain all the details of the employees, members, as well as the details of the equipment
present in the gym, payment details etc. (Xia et al., 2013) The compromise in the confidentiality of the clients
may cause large loss to the business, the clients may cancel further contract with the company. The faults in the
gym equipment will stop the functionality of the gym. The consequence of mishandling of the IT system of the
gym can cause leakage of information from the internal information system. The consequence of have