Asset, Threat and Vulnerability Assessments

We help organisations with targeted assessments of what is most important to protect, who or what may threaten the assets, and which weaknesses could be exploited. The assessments are based on NS 5832 and relevant principles in NS 5814, and can be delivered together or as independent, limited-scope analyses of particular functions, locations, objects, systems, value chains or projects.

Three assessments, each with its own purpose

The asset assessment identifies and prioritises what the organisation must protect. It describes the consequences of loss, damage or loss of function and highlights ownership, critical functionality and dependencies.

The threat assessment translates assessments from the authorities, incidents and knowledge of the organisation into relevant actors, actions and scenarios. Intent, capability, access and method are assessed with clear assumptions and uncertainty.

The vulnerability assessment examines whether human, technological and organisational barriers can actually prevent, detect, delay and respond to the scenarios. Document review, interviews, site visits and verification are used as required.

The assessments can be delivered together or separately. NS 5832 is the main basis, while NS 5814 supports scoping, criteria, documentation and the assessment of uncertainty.

The assessments may include

clarification of purpose, object of analysis, geographical and organisational scope, level of detail and requirements for the handling of sensitive information
identification and structuring of assets in suitable categories, with clear ownership, location and links to functions or deliverables
consequence assessment in the event of loss, damage, compromise, alteration or loss of function, with reasoned criteria and visible uncertainty
mapping of critical functionality, internal and external dependencies, alternatives, redundancy and the possibility of recovery
ranking and prioritisation of assets and protection needs, documented in an asset catalogue, asset matrix or asset map
drafting or quality assurance of security objectives based on the prioritised assets
gathering and compilation of relevant threat information from open sources, assessments from the authorities, incident data and the organisation's own experience
identification of relevant threat actors and assessment of their intent, capability, knowledge, access, choice of targets and methods
preparation of organisation-specific threat descriptions and representative scenarios linked to particular assets
mapping of existing human, technological and organisational barriers through document review, interviews, workshops and site visits
assessment of whether the barriers, individually and together, can prevent, detect, verify, alert, delay, respond to and limit the scenarios
identification of vulnerabilities in design, organisation, procedures, competence, communication, maintenance, access management, emergency preparedness and follow-up
assessment of actual access and of the possibility that a threat actor could exploit the weaknesses and affect the assets
documentation of assumptions, data quality, conflicting information, knowledge gaps and uncertainty in each individual assessment
separate reporting or a combined presentation with clear traceability between asset, relevant threat, scenario and identified vulnerability

What does the organisation receive?

The organisation receives a precise knowledge base tailored to the specific need: an asset catalogue and security objectives, an organisation-specific overview of threats and scenarios, or a documented barrier and gap assessment. The assessments can be used directly in the setting of requirements, design, security management and further analysis work.

← Back to Security Act and Risk Analysis

Submit the form below and we will get in touch with you.