• CONSULTING
    • Strategy and business processes
      • Strategic planning and management of the implementation of the strategic plan
      • Business process management – identification, modeling and improvement of business processes
      • Designing a modern IT organization and managing human resource efficiency
      • Project management
    • Digital transformation through Data Management
      • Establish a Data Governance framework and develop a data management strategy
      • Data quality management
      • Data security management
      • Master and metadata management
      • Preparations for the implementation of BI and Big data solutions
      • Estimates of data management maturity
      • Documentation and content management
      • Establish organizations for successful data management and digital transformation
    • Risks and compliances
      • Business risk management (ISO 31000, etc.)
      • Compliance management in business systems
      • Harmonization of operations in majority state-owned companies (Decision of the Government of the Republic of Croatia OG 99/19)
      • Management of the protection of whistleblowers (46/22 OG and ISO 37002)
      • Anti-corruption system management (ISO 37001)
      • Privacy management (ISO 29100)
      • Electronic identification and trust services in accordance with the eIDAS Regulation
    • Information security, Cyber security and business continuity
      • Corporate information security
      • Information security risk management
      • Information security systems management
      • Business continuity management
      • Cyber security management
      • Incident management, disaster recovery
      • Alignment with the EU regulation 2016/1148, the law and the regulation on cyber security
    • Quality, environment protection and energy efficiency
      • Implementation and evaluation of quality management system (ISO 9001, ISO 15017, etc.)
      • Implementation and assessment of environmental management system (ISO 14001)
      • Implementation and evaluation of energy efficiency management system (ISO 50001)
      • Implementation and evaluation of occupational health and safety management systems (ISO 45001)
    • IT Governance & IT Management
      • Design of ICT Governance & ICT Management systems
      • Development of a new IT strategy
      • Designing a modern IT organization and managing human resource efficiency
      • Management and supervision of IT projects
      • Information system development, verification, validation and testing services
      • Development of technical specifications for the development of information systems
      • Information systems audit
    • IT services
      • Managing IT services
      • Implementation of IT service management system (ISO 20000)
      • ITIL & managing IT services
    • EU projects
      • Identify opportunities for financial support and select the best source of funding
      • Preparation of project application in accordance with EU guidelines
      • EU project management
  • EDUCATIONS
    • Education calendar
  • e-learning
  • ABOUT US
    • Partners
    • ZIH team
    • ZIH’s Authorities
    • Reference list
  • NEWS
  • BLOG
  • CONTACT
Menu
  • CONSULTING
    • Strategy and business processes
      • Strategic planning and management of the implementation of the strategic plan
      • Business process management – identification, modeling and improvement of business processes
      • Designing a modern IT organization and managing human resource efficiency
      • Project management
    • Digital transformation through Data Management
      • Establish a Data Governance framework and develop a data management strategy
      • Data quality management
      • Data security management
      • Master and metadata management
      • Preparations for the implementation of BI and Big data solutions
      • Estimates of data management maturity
      • Documentation and content management
      • Establish organizations for successful data management and digital transformation
    • Risks and compliances
      • Business risk management (ISO 31000, etc.)
      • Compliance management in business systems
      • Harmonization of operations in majority state-owned companies (Decision of the Government of the Republic of Croatia OG 99/19)
      • Management of the protection of whistleblowers (46/22 OG and ISO 37002)
      • Anti-corruption system management (ISO 37001)
      • Privacy management (ISO 29100)
      • Electronic identification and trust services in accordance with the eIDAS Regulation
    • Information security, Cyber security and business continuity
      • Corporate information security
      • Information security risk management
      • Information security systems management
      • Business continuity management
      • Cyber security management
      • Incident management, disaster recovery
      • Alignment with the EU regulation 2016/1148, the law and the regulation on cyber security
    • Quality, environment protection and energy efficiency
      • Implementation and evaluation of quality management system (ISO 9001, ISO 15017, etc.)
      • Implementation and assessment of environmental management system (ISO 14001)
      • Implementation and evaluation of energy efficiency management system (ISO 50001)
      • Implementation and evaluation of occupational health and safety management systems (ISO 45001)
    • IT Governance & IT Management
      • Design of ICT Governance & ICT Management systems
      • Development of a new IT strategy
      • Designing a modern IT organization and managing human resource efficiency
      • Management and supervision of IT projects
      • Information system development, verification, validation and testing services
      • Development of technical specifications for the development of information systems
      • Information systems audit
    • IT services
      • Managing IT services
      • Implementation of IT service management system (ISO 20000)
      • ITIL & managing IT services
    • EU projects
      • Identify opportunities for financial support and select the best source of funding
      • Preparation of project application in accordance with EU guidelines
      • EU project management
  • EDUCATIONS
    • Education calendar
  • e-learning
  • ABOUT US
    • Partners
    • ZIH team
    • ZIH’s Authorities
    • Reference list
  • NEWS
  • BLOG
  • CONTACT
Search
EN
  • HR
[ivory-search id="3372" title="Search form laptop"]

HR 

  • KONZALTING
    • Strategija i poslovni procesi
      • Strateško planiranje i upravljanje implementacijom strateškog plana
      • Upravljanje poslovnim procesima – identifikacija, modeliranje i unapređenje poslovnih procesa
      • Izrada nove organizacije te upravljanje razvojem karijere i radnim učincima djelatnika
      • Upravljanje projektima
    • Digitalna transformacija kroz upravljanje podacima
      • Uspostava Data Governance okvira i izrada strategije upravljanja podacima
      • Upravljanje kvalitetom podataka
      • Upravljanje sigurnošću podataka
      • Upravljanje matičnim i meta podacima
      • Pripreme za implementaciju rješenja za BI i Big data
      • Procjena zrelosti upravljanja podacima
      • Upravljanje dokumentacijom i sadržajem
      • Uspostava organizacije za uspješno upravljanje podacima i digitalnu transformaciju
    • Rizici i usklađenosti
      • GDPR/Upravljanje zaštitom privatnosti
      • Uspostava CMS-a(Compliance Management System) kao dio digitaliziranog sustava upravljanja cijelim poslovnim sustavom
      • Zaštita prijavitelja nepravilnosti
      • Elektronička identifikacija i usluge povjerenja u skladu s eIDAS Uredbom
      • Upravljanje antikorupcijskim sustavom (ISO 37001)
      • Upravljanje poslovnim rizicima
      • Uspostava CMS-a (Compliance Management System) kao pokretača implementacije drugih sustava upravljanja i integracije
      • Uspostava CMS-a (Compliance Management System) kao samostalnog sustava
    • Informacijska sigurnost, kibernetička sigurnost i kontinuitet poslovanja
      • Korporativna informacijska sigurnost
      • Upravljanje rizicima informacijske sigurnosti
      • Upravljanje sustavima informacijske sigurnosti
      • Upravljanje kontinuitetom poslovanja
      • Upravljanje kibernetičkom sigurnošću
      • Upravljanje incidentima, oporavak od katastrofe
      • Usklađivanje s eu uredbom 2016/1148, zakonom i uredbom o kibernetičkoj sigurnosti
    • Kvaliteta, zaštita okoliša i energetska učinkovitost
      • Implementacija i procjena sustava upravljanja kvalitetom (ISO 9001, ISO 15017 i dr.)
      • Implementacija i procjena sustava upravljanja zaštitom okoliša (ISO 14001)
      • Implementacija i procjena sustava upravljanja energetskom učinkovitosti (ISO 50001)
      • Implementacija i procjena sustava upravljanja zdravljem i zaštitom na radu (ISO 45001)
    • IT Governance & IT Management
      • Oblikovanje ICT Governance & ICT Management sustava
      • Razvoj nove IT strategije
      • Oblikovanje suvremene IT organizacije i upravljanje učinkovitošću ljudskih resursa
      • Upravljanje i nadzor IT projekata
      • Usluge u razvoju, verifikaciji, validaciji i testiranju informacijskih sustava
      • Izrada tehničkih specifikacija za razvoj informacijskih sustava
      • Revizija informacijskih sustava
    • IT usluge
      • Upravljanje IT uslugama
      • Primjena norme ISO 20000 u upravljanju IT uslugama
      • ITIL i upravljanje IT uslugama
    • EU projekti
      • Identifikacija mogućnosti dobivanja financijske potpore i odabir najboljeg izvora financiranja
      • Izrada projektne prijave u skladu s EU smjernicama
      • Vođenje EU projekata
  • EDUKACIJE
    • Kalendar edukacija
    • Seminari u ožujku i travnju!
  • e-learning
  • O NAMA
    • Partneri
    • Tim ZIH-a
    • Ovlaštenja ZIH-a
    • Referentna lista
  • NOVOSTI
  • BLOG
  • KONTAKT
Menu
  • KONZALTING
    • Strategija i poslovni procesi
      • Strateško planiranje i upravljanje implementacijom strateškog plana
      • Upravljanje poslovnim procesima – identifikacija, modeliranje i unapređenje poslovnih procesa
      • Izrada nove organizacije te upravljanje razvojem karijere i radnim učincima djelatnika
      • Upravljanje projektima
    • Digitalna transformacija kroz upravljanje podacima
      • Uspostava Data Governance okvira i izrada strategije upravljanja podacima
      • Upravljanje kvalitetom podataka
      • Upravljanje sigurnošću podataka
      • Upravljanje matičnim i meta podacima
      • Pripreme za implementaciju rješenja za BI i Big data
      • Procjena zrelosti upravljanja podacima
      • Upravljanje dokumentacijom i sadržajem
      • Uspostava organizacije za uspješno upravljanje podacima i digitalnu transformaciju
    • Rizici i usklađenosti
      • GDPR/Upravljanje zaštitom privatnosti
      • Uspostava CMS-a(Compliance Management System) kao dio digitaliziranog sustava upravljanja cijelim poslovnim sustavom
      • Zaštita prijavitelja nepravilnosti
      • Elektronička identifikacija i usluge povjerenja u skladu s eIDAS Uredbom
      • Upravljanje antikorupcijskim sustavom (ISO 37001)
      • Upravljanje poslovnim rizicima
      • Uspostava CMS-a (Compliance Management System) kao pokretača implementacije drugih sustava upravljanja i integracije
      • Uspostava CMS-a (Compliance Management System) kao samostalnog sustava
    • Informacijska sigurnost, kibernetička sigurnost i kontinuitet poslovanja
      • Korporativna informacijska sigurnost
      • Upravljanje rizicima informacijske sigurnosti
      • Upravljanje sustavima informacijske sigurnosti
      • Upravljanje kontinuitetom poslovanja
      • Upravljanje kibernetičkom sigurnošću
      • Upravljanje incidentima, oporavak od katastrofe
      • Usklađivanje s eu uredbom 2016/1148, zakonom i uredbom o kibernetičkoj sigurnosti
    • Kvaliteta, zaštita okoliša i energetska učinkovitost
      • Implementacija i procjena sustava upravljanja kvalitetom (ISO 9001, ISO 15017 i dr.)
      • Implementacija i procjena sustava upravljanja zaštitom okoliša (ISO 14001)
      • Implementacija i procjena sustava upravljanja energetskom učinkovitosti (ISO 50001)
      • Implementacija i procjena sustava upravljanja zdravljem i zaštitom na radu (ISO 45001)
    • IT Governance & IT Management
      • Oblikovanje ICT Governance & ICT Management sustava
      • Razvoj nove IT strategije
      • Oblikovanje suvremene IT organizacije i upravljanje učinkovitošću ljudskih resursa
      • Upravljanje i nadzor IT projekata
      • Usluge u razvoju, verifikaciji, validaciji i testiranju informacijskih sustava
      • Izrada tehničkih specifikacija za razvoj informacijskih sustava
      • Revizija informacijskih sustava
    • IT usluge
      • Upravljanje IT uslugama
      • Primjena norme ISO 20000 u upravljanju IT uslugama
      • ITIL i upravljanje IT uslugama
    • EU projekti
      • Identifikacija mogućnosti dobivanja financijske potpore i odabir najboljeg izvora financiranja
      • Izrada projektne prijave u skladu s EU smjernicama
      • Vođenje EU projekata
  • EDUKACIJE
    • Kalendar edukacija
    • Seminari u ožujku i travnju!
  • e-learning
  • O NAMA
    • Partneri
    • Tim ZIH-a
    • Ovlaštenja ZIH-a
    • Referentna lista
  • NOVOSTI
  • BLOG
  • KONTAKT
Menu
  • Konzalting
    • Strategija i poslovni procesi
      • Strateško planiranje i upravljanje implementacijom strateškog plana
      • Upravljanje poslovnim procesima – identifikacija, modeliranje i unapređenje poslovnih procesa
      • Izrada nove organizacije te upravljanje razvojem karijere i radnim učincima djelatnika
      • Upravljanje projektima
    • Digitalna transformacija kroz upravljanje podacima
      • Uspostava Data Governance okvira i izrada strategije upravljanja podacima
      • Upravljanje kvalitetom podataka
      • Upravljanje sigurnošću podataka
      • Upravljanje matičnim i meta podacima
      • Pripreme za implementaciju rješenja za BI i Big data
      • Procjena zrelosti upravljanja podacima
      • Upravljanje dokumentacijom i sadržajem
      • Uspostava organizacije za uspješno upravljanje podacima i digitalnu transformaciju
    • Rizici i usklađenosti
      • GDPR/Upravljanje zaštitom privatnosti
      • Uspostava CMS-a(Compliance Management System) kao dio digitaliziranog sustava upravljanja cijelim poslovnim sustavom
      • Zaštita prijavitelja nepravilnosti
      • Elektronička identifikacija i usluge povjerenja u skladu s eIDAS Uredbom
      • Upravljanje antikorupcijskim sustavom (ISO 37001)
      • Upravljanje poslovnim rizicima
      • Uspostava CMS-a (Compliance Management System) kao pokretača implementacije drugih sustava upravljanja i integracije
      • Uspostava CMS-a (Compliance Management System) kao samostalnog sustava
    • Informacijska sigurnost, kibernetička sigurnost i kontinuitet poslovanja
      • Korporativna informacijska sigurnost
      • Upravljanje rizicima informacijske sigurnosti
      • Upravljanje sustavima informacijske sigurnosti
      • Upravljanje kontinuitetom poslovanja
      • Upravljanje kibernetičkom sigurnošću
      • Upravljanje incidentima, oporavak od katastrofe
      • Usklađivanje s eu uredbom 2016/1148, zakonom i uredbom o kibernetičkoj sigurnosti
    • Kvaliteta, zaštita okoliša i energetska učinkovitost
      • Implementacija i procjena sustava upravljanja kvalitetom (ISO 9001, ISO 15017 i dr.)
      • Implementacija i procjena sustava upravljanja zaštitom okoliša (ISO 14001)
      • Implementacija i procjena sustava upravljanja energetskom učinkovitosti (ISO 50001)
      • Implementacija i procjena sustava upravljanja zdravljem i zaštitom na radu (ISO 45001)
    • IT Governance & IT Management
      • Oblikovanje ICT Governance & ICT Management sustava
      • Razvoj nove IT strategije
      • Oblikovanje suvremene IT organizacije i upravljanje učinkovitošću ljudskih resursa
      • Upravljanje i nadzor IT projekata
      • Usluge u razvoju, verifikaciji, validaciji i testiranju informacijskih sustava
      • Izrada tehničkih specifikacija za razvoj informacijskih sustava
      • Revizija informacijskih sustava
    • IT usluge
      • Upravljanje IT uslugama
      • Primjena norme ISO 20000 u upravljanju IT uslugama
      • ITIL i upravljanje IT uslugama
    • EU projekti
      • Identifikacija mogućnosti dobivanja financijske potpore i odabir najboljeg izvora financiranja
      • Izrada projektne prijave u skladu s EU smjernicama
      • Vođenje EU projekata
  • Edukacije
    • Kalendar edukacija
    • Seminari u ožujku i travnju!
  • e-learning
  • O nama
    • Partneri
    • Tim ZIH-a
    • Ovlaštenja ZIH-a
    • Referentna lista
  • Novosti
  • Blog
  • Kontakt
  • En
    • Hr

Homepage > Consulting > Information security, Cyber security and business continuity > Information security risk management

Information security risk management

What is information security risk management?

Information security risk management is a set of coordinated activities by which the company is directed and controlled in order to conduct an effective assessment and resolution of information security risks over time.
 
Information has become the most important currency of today and is the fundamental drive of every business system. Due to its imperative importance, it is necessary to establish a system of controls and measures in order to achieve an adequate level of protection irrespective of its form. Due to the inevitable application of information and communication technologies in almost all areas of life and in particular business, the security of information systems is particularly important, and should be considered as a basis for efficient and successful business operations. No system can be fully protected but measures can be taken to increase the level of protection. Regardless of the magnitude of the threat, it can always exploit a vulnerability of the system, causing some damage that can be negligible but also significant. Timely identification of vulnerabilities and threats enables the company to mitigate or prevent damage. The information security risk management process is not easy and is an important component for the successful functioning of the information system and thus the company itself. Information security protects information from a wide range of threats, in order to ensure business continuity, minimise business damage and maximise return on investment and create new business opportunities.
 
The main task of information security risk management is to meet security requirements that comply with the requirements of all stakeholders of the company, while determining an acceptable point of relation between investments in security controls and the cost in case of occurrence of a security incident or threat.
 
Standard ISO 27005 on information security risk management goes beyond specific passwords, firewalls, filters and encryption and describes a systematic approach to information security risk management and process design in accordance with its provisions is essential for the successful implementation of the information security management system. The set of ISO 27000 standards is strictly calibrated according to risk treatment, and it is important that companies assess risks at the outset and then before establishing risk management and treatment plans.
 
ISO 27005 has been developed to help companies implement a formal and documented risk assessment, treatment, acceptance, information and monitoring process.

What are the benefits of information security risk management?

ISO 27005 describes the processes constituting the information risk management system, which are:
 
the establishment of a context refers to the collection of relevant company information in order to define risk assessment criteria such as:
the strategic value and criticality of the information asset;
legal, regulatory and contractual obligations;
the importance of protecting information assets (accessibility, confidentiality and integrity);
the expectations of all stakeholders;
the impact of security events on business.
an information security risk assessment, through which:
determine the value of the information asset;
identify vulnerabilities and threats;
identify existing controls;
assess the potential consequences for a security event;
determines the priority of the risks and thus the order in which they are processed.
handling information security risks, whereby the company decides whether:
apply new or change existing controls;
accept the risk;
avoid risk by suspending activities leading to the occurrence of risk;
transfer and share the risk to third parties (e.g. insurance company).
the acceptance of residual risks after the implementation of the risk management;
informing all stakeholders about risks and how risks are handled;
the monitoring and reassessment of information security risks shall be carried out, inter alia, where:
added new information assets falling within the scope of risk management;
the value of the information asset has changed (increase, decrease or has become critical);
emerging knowledge of emerging vulnerabilities and threats;
an increased impact on business due to a potential security event;
there‘s been an information security breach.
 
By implementing the information security risk management system, the company:
 
recognises more effectively the threats and vulnerabilities of its information assets;
establish a framework to protect essential aspects of its business (operational, financial, reputational);
complies with regulatory and regulatory regulations (if any);

How can ZIH help you?

For each ZIH user, it has an individualised approach depending on its needs. In accordance with this, we organize workshops with management teams and, with the expert guidance of our consultants and the application of world reference recommendations, we help users successfully implement processes of systematic information security risk management.
 
Consulting services that we can provide you with:
 
preparing approaches to information security risk management;
establishing an information security risk management process;
the choice of a method for managing information security risks;
developing a procedure for information security risk management;
carrying out the identification of information security risks;
carrying out an information security risk assessment;
advice on the selection of controls and ways to mitigate information security risks;
developing a framework of responsibility for information security risks;
consultations in the implementation of solutions into practice;
an information security risk management audit;
Preparation of GAP analysis of compliance with regulatory, legal and other regulations and standards.
 
For the purpose of better mutual understanding, we organise workshops through which we provide users with guidelines on how to:
 
understand and define the context of their company‘s operations;
identify all key stakeholders;
identify the information asset, its value and importance;
identify the vulnerabilities, threats and risks of their business;
recognise operational risks of the use of ICT.
 
Education in the following field:
 
Why and how to manage information security risks?
Certified ISO 27005 Foundation (PECB)
Certified ISO 27005 risk Manager (PECB)
Certified ISO 27005 led risk Manager (PECB)
  • Why and how to manage information security risks?
  • Certified ISO 27005 Foundation (PECB)
  • Certified ISO 27005 Risk Manager (PECB)
  • Certified ISO 27005 Lead Risk Manager (PECB)

You may also be interested in these services and trainings:

Education

Why and how to manage business risks

Read more

Education

Compliance management in the business system

Read more

Service

Cyber security management

Read more

Service

Information security risk management

Read more

Why ZIH?

ZIH has more than 20 years of rich experience in shaping the modern organization of business risk management systems and in particular information security risks, and closely monitors the development and implementation of standards related to this topic (like ISO 31000, ISO 27005). It has also successfully carried out a number of assessments of business, information technology use and information security risks.

Do you want a short presentation or offer?

REQUEST AN INQUIRY

Contact us

Fill out the form and our staff will contact you and arrange a visit or online meeting to find out how we can help you.
We want to share with you our experiences and the latest trends that can help you in your daily business.

Consulting

Strategy and business processes

Digital transformation through Data Management

Risks and compliances

Information security and business continuity

Quality, environment protection and energy efficiency

IT Governance & IT Management

IT services

EU projects

EDUCATIONS

Strategy and business processes

Digital transformation through Data Management

Risks and compliances

Information security and business continuity

Quality, environment protection and energy efficiency

IT Governance & IT Management

IT services

EU projects

EDUCATION CALENDAR

ABOUT US

Partners

ZIH team

ZIH’s Authorities

Reference list

NEWS

BLOG

NEWS

BLOG

CONTACT

Trg Antuna, Ivana i Vladimira Mažuranića 8, 10 000 Zagreb
 
Telefon: +385 1 4855 271
Fax: +385 1 4855 272
E-mail: zih@zih.hr
 
IBAN: HR7423400091100013041
 
OIB: 34774399108

NEWSLETTER

Stay up to date with the news and services we provide
Facebook Youtube Linkedin
Copyright © 2022. ZIH
Pravila privatnosti
Mask Group
iso-9001-bureau-veritas-logo
Iso_Trans_Logo-01
Dizajn i programiranje: Prospekt d.o.o.
Copyright © 2022. ZIH

Privacy policy

Mask Group
iso-9001-bureau-veritas-logo
Iso_Trans_Logo-01
Design and programming: Prospekt d.o.o.