Information Security Risk Assessment Process

Data classification and asset valuation
The data classification and asset valuation phase evaluates projects against the university’s information classification levels and assigns an asset value based on data sensitivity and regulatory requirements. This foundation ensures that all risk decisions remain focused on what matters most to the university’s mission and compliance responsibilities.

Risk assessment
A risk assessment phase evaluates third-party or internal services, applications, and systems. This phase uses intake questionnaires, public policy reviews, and security documentation to gather vendor, system, or project details. Data sensitivity, technical safeguards, and hosting environments are factored to produce a clear risk rating (High, Medium-High, Medium-Low, or Low) and practical mitigation strategies.

Reporting
A comprehensive report summarizes the risk assessment, outlines identified risks, recommends mitigation strategies for each risk, and documents the remaining risks in our university-wide risk register. Annual recertifications are recommended to reassess the security posture of both internal and external services and partnerships and reinforce the protection of Rutgers data in an ever-evolving threat landscape.