Guide for Conducting Risk Assessments: Information Security

Yigal Rechtman, CPA, CFE, CITP, CISM

Although Guide for Conducting Risk Assessments: Information Security is not a book that one can purchase in a store, it reads just like one (Special Publication 800-30, Revision I, National Institute of Standards and Technology [NIST], September 2012, http://csrc.nist.gov/publications/nistpubs/800-30-rev1/sp800_30_r1.pdf). It is well organized and contains a wide range of risk-related concepts that can be helpful to C-suite executives, accountants, auditors, and compliance officers. Risk assessment is found in many aspects of the profession, from managing risk in business and industry; to assessing risk in financial audits and other attestation engagements; to compliance and monitoring requirements, such as those under the Health Information Portability and Accountability Act (HIPAA). According to Thompson.com, “while the [HIPAA] rule does not specifically require compliance with NIST standards, the U.S. Department of Health and Human Services has referenced them frequently in this and other contexts” (David Slaughter, “NIST Issues Updated Risk Assessment Guidance,” Thompson, http://prodadmin1.tmg.atex.cniweb.net:8080/preview/www/2.3305/2.3443/1.111564).