Information Risk Management Policy, Part A (Writing Information Security Policies Book 16)

Information Risk Management involves the mitigation of risks to acceptable levels based on risk tolerance criteria in order to achieve appropriate protection for all critical information assets. Regulators regularly urge senior managers to know and understand their risks, this involves a great deal more than information risk but certainly includes information risk. IRM is the methodology for gaining that knowledge and understanding. In this period of rapidly escalating risk based on increasingly sophisticated threats and their ever more clever attacks, information risk has never been greater or understanding it a more urgent issue.