{"id":1088,"date":"2026-05-29T09:25:27","date_gmt":"2026-05-29T14:25:27","guid":{"rendered":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/?page_id=1088"},"modified":"2026-06-05T13:37:51","modified_gmt":"2026-06-05T18:37:51","slug":"information-security-risk-assessment-process","status":"publish","type":"page","link":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/information-security-risk-assessment-process\/","title":{"rendered":"Information Security Risk Assessment Process"},"content":{"rendered":"
\n\n
\n
\n
\n\t\t\t\t
\"\"\n\t\t\t<\/div>\n <\/div>\n <\/div>\n\t\n
\n
\n
\n
\n\t\t\t\t

Information Security Risk Assessment Process<\/h1>\n\n<\/div>\n\t\t\t\t
<\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n\n<\/div>\n\n <\/section>\n\n\n
\n\n
\n \n\n\n\n\n\n
\n\n
\n\n
\n \n
\n

This process ensures that all risk decisions remain focused on what matters most to the university\u2019s mission and compliance responsibilities.<\/p>\n <\/div>\n \n <\/div>\n\n

\n
\n <\/i>\n <\/div>\n \n \n
\n\n
\n
\n <\/div>\n

\n <\/h3>\n <\/div>\n \n \n\n
\n

Data classification and asset valuation<\/strong>
\nThe data classification and asset valuation<\/strong> phase evaluates projects against the university\u2019s information classification levels and assigns an asset value based on data sensitivity and regulatory requirements. This foundation ensures that all risk decisions remain focused on what matters most to the university\u2019s mission and compliance responsibilities.<\/p>\n <\/div>\n\n <\/div>\n\n <\/div>\n

\n
\n <\/i>\n <\/div>\n \n \n
\n\n
\n
\n <\/div>\n

\n <\/h3>\n <\/div>\n \n \n\n
\n

Risk assessment<\/strong>
\nA risk assessment<\/strong> phase evaluates third-party or internal services, applications, and systems. This phase uses intake questionnaires<\/strong>, public policy reviews, and security documentation to gather vendor, system, or project details. Data sensitivity, technical safeguards, and hosting environments are factored to produce a clear risk rating (High, Medium-High, Medium-Low, or Low)<\/strong> and practical mitigation strategies.<\/p>\n <\/div>\n\n <\/div>\n\n <\/div>\n

\n
\n <\/i>\n <\/div>\n \n \n
\n\n
\n
\n <\/div>\n

\n <\/h3>\n <\/div>\n \n \n\n
\n

Reporting<\/strong>
\nA comprehensive report<\/strong> summarizes the risk assessment, outlines identified risks, recommends mitigation strategies<\/a> for each risk, and documents the remaining risks<\/strong> in our university-wide risk register. Annual recertifications are recommended to reassess the security posture of both internal and external services and partnerships and reinforce the protection of Rutgers data in an ever-evolving threat landscape.<\/p>\n <\/div>\n\n <\/div>\n\n <\/div>\n \n \n <\/div>\n\n <\/div>\n\n<\/div>\n\n <\/section>\n\n\n

\n\n
\n \n
\n
\n\t\t

\n Request services <\/h2>\n<\/div>\n
\n\t\t\t

Whether you\u2019re launching a new application, onboarding a vendor, or need a quick security consult, the Information Security Risk Management team<\/strong> is ready to help.<\/p>\n

Contact us<\/a><\/p>\n<\/div>\n <\/div>\n <\/div>\n<\/div>\n<\/div>\n\n <\/section>\n\n\n

\n\n
\n <\/a>\n \n\n\n\n\n\n
\n\n
\n\n
\n

Mitigation strategies<\/h2>\n \n
\n

Business application owners, along with data and system owners, are ultimately responsible for making informed decisions regarding projects and vendor engagements. To support this responsibility, the following risk mitigation strategies are provided to guide the evaluation and management of potential risks:<\/p>\n <\/div>\n \n <\/div>\n\n

\n
\n <\/i>\n <\/div>\n \n \n
\n\n
\n
\n <\/div>\n

\n Risk Acceptance <\/h3>\n <\/div>\n \n \n\n
\n

Acknowledge and formally accept the identified risks when the impact is minimal or within the organization\u2019s risk tolerance.<\/p>\n <\/div>\n\n <\/div>\n\n <\/div>\n

\n
\n <\/i>\n <\/div>\n \n \n
\n\n
\n
\n <\/div>\n

\n Risk Transfer <\/h3>\n <\/div>\n \n \n\n
\n

Shift responsibility for specific risks to third parties through mechanisms such as insurance coverage or contractual obligations.<\/p>\n <\/div>\n\n <\/div>\n\n <\/div>\n

\n
\n <\/i>\n <\/div>\n \n \n
\n\n
\n
\n <\/div>\n

\n Risk Avoidance <\/h3>\n <\/div>\n \n \n\n
\n

Decide not to proceed with an engagement or activity to minimize exposure to high or unacceptable risks.<\/p>\n <\/div>\n\n <\/div>\n\n <\/div>\n

\n
\n <\/i>\n <\/div>\n \n \n
\n\n
\n
\n <\/div>\n

\n Risk Reduction <\/h3>\n <\/div>\n \n \n\n
\n

Implement additional technical, administrative, or physical controls to decrease the likelihood or impact of identified risks.<\/p>\n <\/div>\n\n <\/div>\n\n <\/div>\n \n \n <\/div>\n\n <\/div>\n\n<\/div>\n\n <\/section>\n\n\n

\n\n
\n \n
\n
\n

\n <\/h2>\n<\/div>\n

By leveraging these strategies, business, data, and system owners can align risk-based decisions with operational goals, ensuring the security and resilience of Rutgers\u2019 systems and data assets.<\/p>\n<\/div>\n <\/div>\n\n

\n \n <\/div>\n<\/div>\n\n