Defining your risk appetite
How to create simple definitions of risk appetite levels, and then assign these to each of your organization’s projects, services, business units or any other clearly identifiable part of your work.
Blogs that appear below are published on the Optimal Service Management web site.
Major incidents and security breaches are different. Learning from experience can turn out to be hugely expensive, or even result in the organization concerned going out of business. So how can you make sure that you handle these incidents correctly first time?
If you define an incident as "... interruption to an IT service..." then you're not really focussing on customers. One of my clients has a much more business-focussed definition, and this drives completely different behaviours...