IT systems are the most common object of risk assessments in Diri. An IT (or ICT — information and communication technology) system is a set-up of hardware, software, data and the people who use them, often including communication technology such as the internet. Framing a risk assessment around a system is a sensible way to limit its scope.
IT systems allow us to:
Information is stored and processed in digital systems and flows between them. Dividing your risk assessments into systems makes the work easier and allows you to prioritise.
IT can quickly become a "black box" where new systems are introduced and used without anyone knowing the risks. Management might not know which systems are critical for day-to-day business and need extra security.
Building your risk management programme on IT systems helps you gain oversight and control of one of the most crucial areas of your business. You map out the critical systems, register key attributes such as system owners and security requirements, and keep track of the risks associated with each system.
A typical business has inbound logistics, production and distribution, supported by many kinds of IT systems, for example:
A system can serve more than one purpose: a system used for invoicing might also be used for paying salaries. Or they can be two systems that need separate risk assessments.
Register your systems under IT Systems in the Vendors, Systems & Processes group in the left menu, so you can prioritise the most critical systems for analysis first. Several tools help you find them:
The purpose of delimitation is to scope the assessment so it can be completed within a sensible time frame. Every business has its own jungle of IT systems, and you can seldom assess everything at once. It therefore makes sense to divide the IT area into smaller pieces.
Finding a sensible delimitation can be hard: a system can consist of several components, data is sent to and received from many other applications, and authentication may happen in a third-party component. Diri does not put a strict frame on what an IT system is, because it sometimes makes sense to include several components in one assessment. For web services, for example, it can make sense to include the hosting, the web page and related components in one system. Other times it is best to delimit to one application, for example: the scope of this assessment is Salesforce and how it is used in our business.
The IT system register maps several properties that affect risk, such as whether the system is internet-facing, how it is hosted, how many users it has, who uses it, and which data it processes. These properties affect the system's risk profile and help you work on the risks that matter.