=================================================================================
The Security Risk Management Guide

                               (c) Microsoft 2004

Version 1.1, released: October 25, 2004
=================================================================================

The Security Risk Management Guide.DOC Download 

*** TechNet:  http://go.microsoft.com/fwlink/?LinkId=30794
*** Download: http://go.microsoft.com/fwlink/?LinkId=32050

Summary
-------
This prescriptive guide helps customers of all types plan, build, and maintain a 
successful security risk management program. In a four phase process, the guide 
explains how to build an ongoing process to measure and drive security risks to 
an acceptable level. 

This guide is technology agnostic and references many industry accepted standards 
for managing security risk. It is an important example of Microsoft's commitment 
to delivering quality guidance to help customers secure their Information 
Technology (IT) infrastructures. This guide incorporates real-world experiences 
from Microsoft IT and also includes input from Microsoft customers and partners.

Tools and Templates
-------------------
This download contains the guide, as listed below, plus several sample templates 
in the <Tools and Templates> directory.

WARNING: These samples are provided as EXAMPLES ONLY. Be sure to review, 
customize, and test the provided tools before using them in any non-test 
environment.

=================================================================================
Folder contents of The Security Risk Management Guide:

	Readme.txt
	 - This Readme file.

	The Security Risk Management Guide.pdf
	- Chapter 1: Introduction to the Security Risk Management Guide
		Chapter 1 introduces the Security Risk Management Guide (SRMG)
		and provides a brief overview of subsequent chapters. It also
		provides information about the following:
		* Keys to succeeding with a security risk management program
		* Key terms and definitions
		* Style conventions in the papers
		* References for further information
  
	- Chapter 2: Survey of Security Risk Management Practices
		Chapter 2 lays a foundation and provides context for the SRMG by 
		reviewing other approaches to security risk management and 
		related considerations, including how to determine your 
		organization's risk management maturity level.

	- Chapter 3: Security Risk Management Overview
		Chapter 3 provides a more detailed look at the four phases of the 
		SRMG process while introducing some of its important concepts and 
		keys to success. The chapter also offers advice on preparing for 
		the program by planning effectively and placing strong emphasis 
		on building a solid Security Risk Management Team that has well 
		defined roles and responsibilities.

	- Chapter 4: Assessing Risk
		Chapter 4 addresses the first phase, Assessing Risk, in detail. 
		Steps in this phase include planning, data gathering, and risk 
		prioritization. Risk prioritization itself is comprised of 
		summary and detailed levels, balancing qualitative and 
		quantitative approaches in order to provide reliable risk 
		information within reasonable trade-offs of time and effort. The 
		output from the Assessing Risk phase is a list of significant 
		risks with detailed analysis that the team can use to make 
		business decisions during the next phase of the process.

	- Chapter 5: Conducting Decision Support
		Chapter 5 addresses the second phase, Conducting Decision 
		Support. During this phase, teams determine how to address the 
		key risks in the most effective and cost efficient manners. Teams 
		identify controls; estimate costs; assess the degree of risk 
		reduction; and then determine which controls to implement. The 
		output of the Conducting Decision Support phase is a clear and 
		actionable plan to control or accept each of the top risks 
		identified in the Assessing Risk phase.

	- Chapter 6: Implementing Controls and Measuring Program Effectiveness
		Chapter 6 addresses the final two phases of the SRMG: 
		Implementing Controls and Measuring Program Effectiveness. During 
		the Implementing Controls phase, the Mitigation Owners create and 
		execute plans based on the list of control solutions that emerged 
		during the decision support process.

		When the first three phases of the security risk management 
		process are complete, organizations should estimate their 
		progress with regard to security risk management as a whole. The 
		final phase, Measuring Program Effectiveness, introduces the 
		concept of a "Security Risk Scorecard" to assist in this effort. 

	- Appendix A: Ad-Hoc Risk Assessments

	- Appendix B: Common Information System Assets

	- Appendix C: Common Threats

	- Appendix D: Vulnerabilities

	<Tools and Templates>

		- SRMGTool1-Data Gathering Tool.doc

		- SRMGTool2-Summary Risk Level.xls

		- SRMGTool3-Detailed Level Risk Prioritization.xls

		- SRMGTool4-Sample Project Schedule.xls


=================================================================================
TERMS OF USE

Microsoft Corporation hopes that the information in this download is valuable 
to you. This download and all files contained within are subject to the standard 
TERMS OF USE for microsoft.com. The TERMS OF USE for this download are located 
at http://www.microsoft.com/info/cpyright.htm
