CRAMM

History

Methodology

Stage 1

• Defining the boundary for the study for Risk Assessment
• Identifying and valuing the physical assets that form part of the system;
• Determining the 'value' of the data held by interviewing users about the potential business impacts that could arise from unavailability, destruction, disclosure or modification;
• Identifying and valuing the software assets that form part of the system.

  Stage 2

• Identifying and assessing the type and level of threats that may affect the system;
• Assessing the extent of the system's vulnerabilities to the identified threats;
• Combining threat and vulnerability assessments with asset values to calculate measures of risks.

  Stage 3

Deployment