Risk acceptance and risk retention may be used interchangeably in other risk management frameworks. However, there are some minute differences from the perspective of ISO 27005.

• Risk Retention is the risk treatment option that no action is taken given the inherent or residual risk meets the risk acceptance criteria defined when establishing the risk context.
• In contrast, Risk Acceptance is a decision on whether the residual risk, produced after risk treatments, such as risk modification, risk share, or risk avoidance, is explicitly accepted by the managers.

For those accepted risks that do not meet the normal risk acceptance criteria, the outcome of risk acceptance should highlight them with stated justification. Risk acceptance criteria may become inadequate and should be revised, but it is not always possible to do so promptly. For example, when it comes to accepting risk with desirable benefits or high cost of risk modification, odds are the outdated risk acceptance criteria cannot be revised timely. In this situation, the decision-maker should explicitly comment on the risks and include a justification for the decision to override normal risk acceptance criteria.

In good old days, people dial up to the ISP with a modem supported by the Point-to-Point Protocol, PPP. The client connected through PPP is authenticated, if required, by PAP or CHAP. The Extensible Authentication Protocol (EAP) is an authentication framework to extend PPP authentication.

EAP defines simple messages and their formats only; request and response are the core messages communicated between the peer (client) and the authenticator (server). EAP specifies how the authenticator requests identity and credential (MD5, OTP, or Token) and notifies the authentication outcome (success or failure). It also determines how the peer responds to the authenticator’s requests. However, EAP does not define how the authenticator verifies and validates the client’s identity, that can be completed by RADIUS, LDAP, or other protocols.

Remote access (e.g., dial-up, VPN), LAN, or wireless networks can authenticate clients through the EAP authentication framework.

PMI OPM Strategy Execution Framework

Strategy Development

What is the Important Strategy Driver?

I came across the following post/question from Thor’s group:

My Justification for Compliance Requirements

Strategy Drivers

A strategy is a high level, overall plan. It typically comprises a collection of initiatives to achieve long-term strategic goals, developed and scoped based on the requirements and constraints from stakeholders and the organization’s internal and external environment. So, we can say strategic goals or requirements drive a strategy.

Effectiveness of a Strategy

An effective strategy should achieve strategic goals, realize benefits, and deliver values to address requirements. Programs, supported by policies and management commitment, implement a strategy. Standards and procedures support a policy.

The Most Important Driver

A, B, C, and D can be sources of requirements and constraints that drive a strategy. If I have to choose the MOST important one, I would vote for B as senior management cares about compliance requirements the most in practice.

Compliance is a long term and broad concern. Laws, regulations, industry standards, contracts, corporate policy framework, ethics, and due diligence/due care are compliance requirements. They are subject to change, and organizations have to monitor and respond to this type of compliance risk over time. A strategy should address these concerns effectively.

Information Security Standards and Organizational Internal Standards

Information security standards, e.g. ISO 27001, do not apply to every organization, while the organization’s internal standards are supporting policies. Policies are developed to support programs that implement a strategy. So, both industrial infosec standards or internal standards play a less significant role in developing a strategy than compliance requirements.

If the question sets the context in an organization that is implementing ISMS per the information security standard, say, ISO 27001, the answer A is appropriate, because the organizational goal is to meet the requirements of the standard and pass the certification audit. In this context, the effectiveness of the InfoSec strategy can be determined by if it meets the requirements of the InfoSec standard.

References

• How to Unite Enterprise and Project Risk Management