of IT resources RE3.3 Understand IT capabilities RE3.4 Update risk scenario components RE3.5 Maintain the IT risk register and iT risk map RE3.6 Develop IT risk indicators Risk Response: Ensure that IT-related risk issues, opportunities and events are addressed in a cost-effective manner and in line with business priorities. It is based on the following processes: RR1 Articulate Risk RR1.1 Communicate IT risk analysis results RR1.2 Report IT risk management activities and state of compliance RR1.3 Interpret independent IT assessment findings RR1.4 Identify IT related opportunities RR2 Manage Risk RR2.1 Inventory controls RR2.2 Monitor operational alignment with risk tolerance thresholds RR2.3 Respond to discovered risk exposure and opportunity RR2.4 Implement controls RR2.5 Report IT risk action plan progress RR3 React to Events RR3.1 Maintain incident response plans RR3.2 Monitor IT risk RR3.3 Initiate incident response RR3.4 Communicate lessons learned from risk events Each process is detailed by: Process components Management practice Inputs and Outputs RACI charts Goal and metrics For each domain a Maturity Model is depicted. Risk evaluation The link between IT risk scenarios and ultimate business impact needs to be established to understand the effect of adverse events. Risk IT does not prescribe a single method. Different methods are available. Among them there are: COBIT Information criteria Balanced scorecard Extended balanced scorecard Westerman COSO Factor Analysis of Information Risk Risk scenarios Risk scenarios is the hearth of risk evaluation process. Scenarios can be derived in two different and complementary ways: a top-down approach from the overall business objectives to the most likely risk scenarios that can impact them. a bottom-up approach where a list of generic risk scenarios are applied to the organizaztion situation Each risk scenarios is analysed determining frequency and impact, based on the risk factors. Risk response The purpose of defining a risk response is to bring risk in line with the overall defined risk appetite of the organization after risk analysis: i.e. the residual risk should be within the risk tolerance limits. The risk can be managed according to four main strategies (or a combination of them): Risk avoidance, exiting the activities that give rise to the risk Risk mitigation, adopting measures to detect, reduce the frequency and/or impact of the risk Risk transfer, transferring to others part of the risk, by outsourcing dangerous activities or by insurance Risk acceptance: deliberately running the risk that has been identified, documented and measured. Key risk indicators