After identifying assets and evaluating them, identifying the risks to them is a necessary part of the implementation of ISMS. Recognizing the risks to different assets and determining the probability of occurrence of each one and the extent of the damage and consequences in the event of occurrence and, finally, the quantitative and qualitative calculation of the amount of risk is the goal of this step. At this step, a list of risks is first provided for each type of asset. After identifying the risks of each asset, identifying the security threats that may lead to its occurrence is done. Ultimately, the vulnerabilities if each asset is identified. To identify risks and threats, one can use interviews with audiences and review are known risks. Also, upstream and downstream requirements and stakeholders’ needs are other sources for identifying risks. Ultimately, the vulnerabilities and weaknesses of the various assets that could lead to the occurrence of threat should be identified. The components of this step are:

• Risk Identification
  There are various events that can affect an asset and consequently “take on a risk.” Identifying the reasons that can endanger the security of the asset, the place where these factors can be problematic and how it is determined and how it is identified. There are many ways and means to define the risks and the reasons for their occurrence, including the checklist, a judgment based on experience and records, flowcharts, collaborative sessions, system analysis, analysis of different scenarios and engineering techniques of the systems. To determine the appropriate method of risk assessment, the following techniques can be considered:

• • Brian storming sessions
  • Structured methods such as flowcharts, review of system design, system analysis, hazard studies
  • Use the experiences of others and prepared tables
• Threat Intelligence
  After identifying different risks, for each risk, the threats that can lead to that risk should be identified. Its origin can be used to fully identify the threats. Threats can be categorized as:

• • Occurrence: Usually occurs without planning and accidental incidents such as natural disasters or equipment failure
  • Intentional: Deliberately and with prior planning like sabotage

From another point of view, it can be classified as follows:

• • Active: If successful, it changes in assets.
  • Inactive: If successful, it does not change the asset, such as eavesdropping.

Any threat to carry out its sabotage requires motivation. Threat motives can be one of these:

• • Financial: It takes to earn money or financial benefits.
  • Opportunistic: Opportunity if available.
  • Business: It is for the benefit of commercial interests.
  • Belief: It is for personal belief or for political or personal reasons.
  • Ability: It is done to show the ability to perform.
• Identification of Vulnerabilities
  In this section, the vulnerability of each group of assets is identified using automated tools and security scans or interviews or observations.

• Risk Evaluation
  In this section, for each risk, records of the occurrence and the amount of control and countermeasures against it are reviewed. In risk assessment for each risk, the probability of occurrence and its consequences should be calculated. Generally, the risks can be divided into two main categories of incidents and cybercrime & vandalism. The first step is to calculate the number and degree of vulnerability for each risk. By identifying the vulnerabilities in each asset and the relationship between each vulnerability with each risk, the severity of the risk is calculated. After that, the probability of occurrence and consequences should be calculated. Also, the number of asset vulnerabilities for a particular risk, previously defined as the vulnerability level, is considered, and the probability of occurrence is calculated by combining these three factors: the rate of occurrence, the amount of coping before damage and the degree of vulnerability. To calculate the extent of the consequences of each risk, two factors influence the risk effect on each security index of each asset and its security index value. 
  The indicators used to calculate the probability of occurrence of cybercrime and sabotage risks include:

• • Attack method (internal-external) from inside or outside of the organization
  • The complexity of the attack (high-low) based on the CVE number of the vulnerability
  • Authentication (requires – does not need)
  • Attack tool (not available – Hardly accessible – Available – No tools needed)
  • Implemented Countermeasures (the definitive strategy applied – the temporary solution implemented – is in place – no solution)
• Creating Risk Matrix
  Now for each risk, based on the probability of occurrence and degree of impact, the risk level and its position in the risk matrix are determined. The risk number is the probability of occurrence of a risk multiplied by its impact.

The security strategic plan outlines the overarching framework for safeguarding an organization’s assets and information systems. It begins with defining clear security goals aligned with business objectives, establishing measurable security objectives to guide implementation efforts. In order to measure the success rate in the implementation of the information security management system, the objectives and the method of measuring it should be determined. In fact, the effectiveness of this system and the concept of security, which is an intangible concept, can be measured. For this purpose, different indexes such as risk number, and maturity levels are used.

Setting a risk acceptance level helps determine the threshold for tolerable risk exposure, informing decision-making processes regarding risk mitigation strategies. The security strategy encompasses a comprehensive approach to risk management, including preventive, detective, and corrective measures, as well as incident response protocols, security awareness training, and continuous monitoring to ensure proactive threat mitigation and alignment with the organization’s risk appetite and operational needs.

Activities of this step are:

• Setting Security Goals and Objectives
• Setting Risk Acceptance Level
• Security Strategy Development

The purpose of this step is to develop the statement of the information security policy, technical policies & procedures for policy implementation.

• Security Policy Development
  Information Security Policy is a high-level document that describes security requirements.

• Security Technical Policies Development
  In this step, security policies are being developed to provide a systemic response to security risks. The technical security policies are in fact systems management solutions for threats, and their content should result from risk analysis and statement of applicability. Policies are the first level of system documentation that their initial list is based on the recognition and the requirements presented in the standard text and the results of the risk analysis and statement of applicability. Information Security Policies are based on the following two types:

• • Subject-based security policies
  • System-based security policies
• Security Procedures Development
  Security procedures are defined for enforcing security policies. A procedure defines mechanisms for security regulation. Based on the technical security policies and requirements in the standard text and the results of the risk analysis and the statement of applicability, a draft of the procedures is prepared and reviewed at the meetings with the relevant authorities.

The purpose of this step is to provide solutions to address the identified risks. Based on the acceptable level of risk, a solution and security plan is provided to manage risks that are beyond acceptable levels. Major tasks of this step are, developing risk management plan, determination the effectiveness of the solutions based on defined indicators, and the determination of the extent to which the objectives are achieved in the event of full implementation of the plan.

• RTP Development
  Risk Treatment Plan can be divided into technical and systemic solutions. The technical solutions includes a variety of hardware, software, and configurations, and policies, procedures, and training courses are in the systemic solutions. In this activity, appropriate solutions are determined and for each solution, the implementation method, the type of solution’s impact on the security parameters, the type of solution and the related risks will be determined. The followings are determined for each solution:

• • Implementation method which are Hardware, Software, Configuration, Procedure, Training, Awareness
  • The impact of the solution on the security index which is Confidentiality, Integrity, Availability
  • Type of solution which is Preventive, Diagnostic, Reaction, Recovery
  • Related threats
• RTP Effectiveness Assessment
  Now that the list of solutions has been extracted, the impact of each solution is determined. For this purpose, the following are calculated for each solution and for all threats:

• • Number of covering vulnerabilities,
  • Risk number reduction

Definition of the required training and awareness programs are the output of this step. One of the factors that play an effective role in creating and maintaining information security is the awareness of the personnel about their rights, duties, responsibilities regarding the organization’s information security program. In order to develop proper training courses, each person’s role in the information security structure and the description of the respective security duties are considered, the training courses required by each individual to provide an optimal description of the services is identified and by considering the training records of the person his training calendar will be generated. This training calendar is tailor-made by an intelligent and targeted manner. Activities of this step are:

• Training Plan Development
• Awareness Plan Development

In the organization’s information security structure, a plan for managing the accidents including the definition of the duties and responsibilities of each person in different situations should be provided. In this step, while identifying key services, their importance for the organization and the definition of crisis situations and RTO, RPO for the key services are calculated.

• Business Continuity & Disaster Recovery Plan Development
  The general components of a business continuity plan are:

• • Recognition: Identifying key services by assessing the impact of each service deficiencies on the organization’s activities is the first part of this step. After identifying key services, RTO and RPO are calculated for each key service.
  • Strategy development: All possible options and strategies for continuity and return of any key services after failure should be identified and documented.
  • Test: The scope and risks of testing, should be documented and verified by the management. In conducting the tests, all involved in coping with the crisis must have at least one of the tests, and all three test methods (simulation, parallelism and complete stop) must be used.