Assessing risk begins with baselining, establishing a current state to get to the desired state. Progress is measured by meeting milestones and objectives, i.e. a maturing process. For example, the capability maturity model has the following framework:
Initial informal
Documented Strategy & Principles – formalizing
Adaptive Security Architecture well defined
Security Organization & Roadmap – optimized
Baseline Security Standards quantitatively controlled
Give examples of risk at the level of these categories and how each level mitigates risks from the previous level?
