关键词: 风险评估, 实施模型, 高阶信息安全风险评估, 详细信息安全风险评估, 业务信息

Abstract: Information risk assessment is the core component of risk management and control, but there are some problems in the process of implementation. Based on the revised national standards, this paper proposes three implementation models for the implementation of information security risk assessment, namely, High-level Information Security Risk Assessment Implementation Model. Detailed Information Security Risk Assessment Implementation Model, Detailed Information-High-level Information Security Risk Assessment Implementation Model. Through the study of three models, this paper discusses how to carry out the risk assessment of information security better under different circumstances, and puts the core content of the standard revision into the work. The actual cases show that the three models can effectively solve problems such as the limitations of current evaluation objects, the lack of information security risk assessment at the business level, and the lack of the basis or method for the overall risk assessment of the business or organization. The three models can effectively guide the information security risk assessment, meet the assessment needs from asset to business, from the individual to the whole, and provide a reliable basis for decision-making and implementation of security measures.

Key words: risk analysis, implementation model, high-level information security risk assessment, detailed information security risk assessment, business information security