Security Risk Analyses

We carry out security risk analyses of intentional undesirable actions based on the organisation's assets, relevant threats and existing vulnerabilities. The analyses are carried out in accordance with NS 5832 and relevant requirements and principles in NS 5814, and provide a structured, documented and verifiable basis for selecting and prioritising preventive security measures.

From assets and threats to targeted security measures

NS 5832 was developed for intentional undesirable actions and builds on the relationship between asset, threat and vulnerability. We identify what is to be protected, formulate security objectives, describe relevant actors and scenarios and assess how existing barriers work in practice.

Our advisers combine analytical expertise with experience of buildings, infrastructure, information systems, personnel and organisation. This produces realistic scenarios and balanced measures across human, technological, organisational and physical factors. NS 5814 is used as support for scoping, criteria, documentation and the handling of uncertainty.

The security risk analysis may include

start-up, anchoring and clarification of purpose, object of analysis, scope, method, roles and decision points
review of governing documents, existing analyses, incidents, non-conformities, drawings, system overviews and other relevant documentation
interviews and workshops with management, risk owners, specialist teams, operations, ICT, HR, emergency preparedness and other key roles
site visits to the relevant locations to verify the factual basis and understand assets, surroundings, barriers, access routes, zones and operational conditions
asset assessment with identification, consequence assessment and prioritisation of people, information, systems, functions, buildings, facilities and other assets
mapping of internal and external dependencies, alternatives, redundancy and critical functionality
determination and quality assurance of security objectives that give direction to the analysis and the subsequent choice of measures
threat assessment of relevant actors, intent, capability, access, knowledge and possible methods
development and selection of representative scenarios for intentional undesirable actions
consequence assessment with reasoned criteria and assessment of both direct and indirect harm
vulnerability assessment of existing human, technological, organisational and physical barriers in each scenario
compilation and evaluation of risk, including making assumptions, data quality, knowledge gaps and uncertainty visible
assessment of risk strategy and development of alternative security measures with expected effect, cost, responsibility and priority
reassessment of risk and security objectives after the proposed measures, so that the expected residual risk is clear to the decision-maker
reporting, presentation to management and support for further action planning, implementation and periodic updating

What does the organisation receive?

The organisation receives a verifiable security risk analysis with traceability from assets and security objectives to threats, scenarios, vulnerabilities and measures. The deliverable may include an asset catalogue, security objectives, an overview of threats and scenarios, a barrier assessment and a prioritised action plan. Management receives a concrete basis for choosing the level of security and prioritising resources.

← Back to Security Act and Risk Analysis

Submit the form below and we will get in touch with you.