Integrated, Business-Oriented, Two-Stage Risk Analysis

This paper presents an integrated, business-oriented, two-stage risk analysis method related to the Information Security Management Systems (ISMS) concept. The current state of the work is presented, including risk analysis methods and their implementation. The concept assumes the integration of preliminary overviews as well as high- and low-level risk analyses. High-level risk analysis works with the needs of business processes and presents criticality of these processes. Low-level risk analysis works with assets and selects safeguards in a cost-effective manner. It is assumed that the presented risk analysis concept can be used in other management systems: business continuity and IT services management. The paper concludes the current state of the work and defines its further directions.