The organisational risk assessment is the easiest way to get started with risk assessments in Diri. It asks you to briefly describe the parts of your organisation that affect security, such as industrial classification, number of employees, internal and external requirements, and your most important deliveries. In short, it is a strategic risk assessment of your business.
It is a tool for setting the direction of the risk management programme together with the key stakeholders and decision-makers in your organisation.
It lets you assess overarching, strategic risks that are not bound to one system. It has two main purposes.
The first is to quickly identify the business-critical IT systems and register them in Diri. The best way to do this is to discuss the value chain and how IT systems support the core business processes. This discussion will bring out many critical IT systems, but not all: some of the knowledge sits with the IT experts, so include them in the discussion. In the same way, the assessment lets you quickly list your existing organisation-wide security measures — treatments that affect risk in more than one assessment, such as security guidelines, firewalls and single sign-on.
The second purpose is to set the direction of the risk management programme. The assessment asks for the organisation's largest concerns, which are added as events and can guide later risk assessments. For example, if ransomware is the key concern, that risk should be considered in all risk assessments. The same goes for information assets: business-critical assets can be identified here and reused throughout the organisation.
Assets, threats, vulnerabilities and treatments are stored in your organisation's central registers and can be reused in other assessments. To make them available to sub-organisations, use inheritance, see What is offered to the organisations below.
If you are about to do your first risk assessment in your organisation, the organisational risk assessment should be your first choice. Use it to define critical risks for the organisation and quickly populate the IT systems register and the treatment list. It is also the best choice for an overarching security review of your organisation.
The organisational risk assessment asks, among other things:
These fields are what make the organisational risk assessment useful as a starting point. Make good use of them.