COBIT 5 Framework for Risk Management in Information Security

This report provides an overview of COBIT 5 and its application to risk management within information security. It begins by highlighting the key processes of an effective risk management plan, emphasizing the role of COBIT 5 in optimizing and managing risk. The report then delves into the COBIT 5 risk management program, focusing on creating a vendor risk management program to mitigate organizational risks, particularly concerning data breaches. The core of the report details the COBIT 5 risk management process, including the functions EDM03 (ensure the optimization of risk) and APO12 (manage risk). It describes governance and management processes, process activities, goals, and key performance indicators. The report also discusses the integration of IT-related risk management, the management of costs and benefits, and the monitoring of risk targets. Finally, the document references key supporting processes within the COBIT 5 framework and provides relevant references.

INFORMATION SECURITY

Table of Contents
Effective Risk Management Plan.......................................................................................................2
Risk Management Program................................................................................................................2
Risk Management Process..................................................................................................................2
References............................................................................................................................................4
1

Effective Risk Management Plan
Processes of COBIT 5 is specifically deal with risk. It ensures the risk optimization
and manage the risk. The COBIT 5 provides the RISK guide which deal with two functions
such as risk management process and risk function. These are two functions are provides the
effective risk management plan. The risk function is used to describe the how the COBIT 5
enablers can be used to implement the efficient and effective risk management and
governance. It also include the practical example of artefacts from the processes of risk
management. The risk management function and processes are designed to achieve the
specific knowledge of risk management to build capability in managing the risks
(Itgovernance.com, 2017).
Risk Management Program
The COBIT 5 risk management program is used to creating the effective vendor risk
management program to manage the organization risks. The critical business functions are
needs to avoid the data breaches due to the diligence. So, the risk management program was
minimize the risk in critical business by using the COBIT 5 (Isaca.org, 2017).
Risk Management Process
The COBIT 5 is used to provide the complete description of the core risk processes. It
is shown in below.
2

The COBIT risk processes provides the following two functions such as EDM03
ensure the optimization of risk and APO12 manage the Risk (Isaca.org, 2017). The Risk
management process including the description of process, process of governance practices,
process activities, processes of management practices, process goals and suggested the key
performance indicators to measure the process performance. It identifies and provides the
process description to support the core risk management processes. It required to provide the
inputs necessary to support the process of core IT risk management. The COBIT risk
management has two dedicate processes such as governance processes and management
process. The Governance processes are used to ensure the following activities such as
minimize the potential compliance failures, identified and managed the risk to enterprise the
value based on IT related use and its impacts and it does not exceed the risk tolerance and
appetite. The management processes includes the Integrate the management of IT related
risks and managing the balance the benefits and costs related to IT enterprise risks.
The COBIT 5 for risk processes highlights the key supporting processes from the
COBIT 5 framework for the risk management processes. It obtain the specific risk outputs
such as risk management plan, risk management strategy and budgetary and financial
requirements to mitigate and respond the risks. It helps to monitor the risk targets, reports and
metrics on non-compliance root causes and issues. The COBIT 5 risk management processes
3

also includes the following activities such as Ensure the benefits delivery, Manage the costs
and budgets, Manage the relationships, Monitor, assess and evaluate the conformance and
performance and Manage the strategy.
References
Isaca.org. (2017). COBIT 5 for Risk: Making Sense of IT Risk Management. [online]
Available at: http://www.isaca.org/COBIT/focus/Pages/cobit-5-for-risk-making-sense-of-it-
risk-management.aspx?utm_referrer= [Accessed 10 Nov. 2017].
Isaca.org. (2017). Creating an effective vendor risk management program - ISACA Now.
[online] Available at: https://www.isaca.org/Knowledge-Center/Blog/Lists/Posts/Post.aspx?
ID=419 [Accessed 10 Nov. 2017].
Itgovernance.com. (2017). COBIT 5 for Risk. [online] Available at:
http://www.itgovernance.com/index.php/cobit-5-implementations?id=147 [Accessed 10 Nov.
2017].
4