Identifying the ‘unknown’ risks is one of the major goals of Skillmine’s risk management process. Documenting the known risks and capturing as many of the unknown risks as possible reduces the number of surprises and provides a methodical approach to address them. Skillmine defines the risk management process as the “systematic process of identifying, analyzing, and responding to IT risks”. Listing mission-critical activities which the organization depends on in order to meet the commitments to its customers, employees, shareholders, and other stakeholders is the first step in carrying out a risk assessment. Identification of assets and valuation, the next step, will determine those information assets, whose Confidentiality, Integrity, and Availability(CIA) must be ensured. The valuation of the assets is done in terms of impact to the organization if there is a loss of CIA of the information. Standardized checklists may be used to assess various critical systems and processes. In the next step, we determine the threats, probabilities, and impacts. When evaluating the threats and their impact, we consider the controls that are already in place. The impact of the threat is directly related to the value of the asset. It is measured in terms of loss to the organization in case there is a breach of the asset. Risk is calculated and the value arrived at is the final risk to each asset. The risk assessment is carried out at least once every year or as and when new systems or applications or significant network modifications are made. The following risk mitigation steps are taken based on our risk appetite:

• Transfer the risk: for instance, take an insurance cover.
• Accept the risk: if it is too low, or within the risk appetite of Skillmine, nothing needs to be done.
• Reduce the risk: reduce vulnerabilities by putting more preventive controls in place or reducing the impact of the threat with more corrective/detective controls.
• Avoid the risk: by removing the threat.