As part of an information security program, an organization should perform IT risk assessments that provide reliable data about the threats the business faces and the consequent impacts. Many companies are turning to third-party risk assessment software to help monitor, prioritize, and respond to risk.

In contrast to using documents and spreadsheets, software applications can log, track, analyze, and send reminders for key events. In addition, some platforms come with templates to help risk managers evaluate risk by suggesting threats, controls, and residual risk levels.

With all these features and options available, it can be difficult to know what to look for in an information security risk assessment software. This article will look at the top features to consider when evaluating an information security risk assessment software solution, including elements related to inherent and residual risk calculation, inventory and prioritization of assets, risk response, and reporting.

Inherent and Residual Risk

Tracking inherent and residual risk is essential to a risk assessment process. While inherent risk is determined by the impact of an event (a.k.a., "potential damage") and the probability of that event happening (a.k.a., "likelihood"), residual risk is determined by reducing the inherent risk by the effectiveness of the organization's controls.

In other words:

  • Inherent risk = Impact + Probability
  • Residual risk = Inherent Risk - Control Effectiveness

Controls are intended to bring your inherent risk down to an acceptable level. The right risk assessment software will give you a clear representation of your organization's inherent risk and residual risk.

Take your risk assessments a step further by ensuring the third-party software you choose has the option to see an audit history of controls that have been tested to ensure they are adequate. This type of integration will often work hand in hand with an audit management product. 

Risk can be calculated using a scale (e.g., high, moderate, and low) to predict an event's likelihood and potential damage. It is best practice to have standardized scales and calculations used throughout your organization. This is particularly important in qualitative risk assessments to ensure everyone stays on the same page.

In summary, as you consider potential information security risk assessment software solutions, be sure they can help you:

  • Create a list of threats facing your business and your information assets (a.k.a., "risk register").
  • Determine the inherent risk and residual risk of threats to your information security.
  • Identify how controls reduce risk to an acceptable level.
  • Maintain standardized scales and calculations for improving communication.
  • Bonus: Integrate with an audit management solution to show a control's audit history.

Inventory & Prioritize Information Assets

According to the FFIEC IT Examination Handbook, "Information security promotes the commonly accepted objectives of confidentiality, integrity, and availability of information and is essential to the overall safety and soundness of an institution."

Determining the confidentiality, integrity, and availability (CIA) of data associated with an asset is beneficial to the organization because it demonstrates each asset's inherent value. An additional benefit of understanding an asset's CIA is the ability to easily decide which information asset to prioritize. If an asset has a higher CIA rating, then a risk assessment should be done on this asset first before others which have a lower CIA rating. A software solution should provide a picture of your most important assets to determine what resources are needed to manage risk.

When it comes to information asset inventory and prioritization, look for risk assessment software solutions which can help you:

  • Catalog information assets.
  • Easily prioritize information assets according to a CIA Rating.
  • Associate data types and data classifications with the information assets.
  • Bonus: Schedule automated reminders to review information asset documentation.

Risk Response

Risk management aims to bring risk to an acceptable or tolerable level for the organization. Risk response strategies will ensure that the residual risk falls within the risk appetite. The four risk response options are:

  • Risk acceptance
  • Risk mitigation
  • Risk transfer
  • Risk avoidance (defer)

Once an appropriate risk response option is selected, it is important to document risk management plan details for risks greater than a low-risk level. The risk management plan details will include the steps your organization will take to bring the residual risk to an acceptable level.

With risk response in mind, a third-party software solution should:

  • Help users be proactive with creating risk mitigation plans.
  • Track when mitigation plans are missing.
  • Provide easy-to-understand reporting on current mitigation plans.
  • Bonus: Offer versioning to show how risk mitigation plans change over time.

Risk Reporting

It's wonderful to see all your hard work come together in a professional, straightforward, and easy-to-manage report. A software solution should make it easy for you to provide a risk assessment summary and build documents to focus on specific information like your top five assets or the list of controls mitigating the threats. Risk reporting should be clear, concise, and include useful information relevant to the target audience.

A software solution should have the ability to generate risk reporting to help the organization:

  • Identify risks and gaps in the risk assessment program.
  • Create an in-depth report on the status of information security risks facing the business.
  • Prepare audit and board reports with clear and relevant data.
  • Bonus: Include a custom-report builder to allow you to create your own template documents.

Download our Risk Assessment Software Review Excel Tool for a more exhaustive list of features you may want to consider when evaluating potential risk assessment solutions.