Do you know the applications most critical to your business success? Have you quantified the cost of downtime or information loss due to a security incident? Do you know where these applications are most vulnerable? The security dependencies on other IT infrastructure, like remote network access, VPNs, or shared storage? Did you use a formal security audit to arrive at these conclusions, and do you have ongoing audit and logging processes in place to verify continued security compliance? A sound risk management program promises answers to these questions and more; information that will maximize the return on your IT security investment.
InformationWeek is taking the pulse of our readers' risk management practices in our latest Risk Survey. We want to see not only how many of you have programs in place, but how you've implemented them, including the methods, organizational changes, and tools used. We'll use the data and any written comments (always one of the most interesting parts of any results) as part of an InformationWeek cover story and full Analytics report that will lay out the key steps in building an IT risk management program.
The survey, available here runs through January 3 and will take under 10 minutes to complete. You'll then be eligible to enter a drawing for an Apple 16GB, Wi-Fi iPad, so if Santa didn't come through, here's a second chance to score the gadget on everyone's wish list. If you're nervous about your responses showing up on Wikileaks, rest assured that everything's confidential and responses are only reported in aggregate.
If taking the survey leads to a resolution to make 2011 the year you take control over your IT security portfolio, a great starting place is the NIST Risk Management Guide for Information Technology Systems [pdf]. Slap this on your iPad (Santa willing) and take a gander during half time of one of those many bowls we'll all be dozing through.