关键词: 风险评估, 服务资质认证, 信息安全风险评估服务能力, 计算模型, 风险评估技术实践

Abstract: For organizations that provide information security risk assessment services to the outside world, certification of information security risk assessment service qualification is an important way to embody their technical and management capabilities. During the process of qualification certification for risk assessment services, our center found that most units often lack the basis, objectivity and persuasiveness in the implementation of risk assessment. When the risk assessment results are exported, they tend to focus on various charts and calculation models. This paper will explain the problems found, and based on the practice of risk assessment, give the idea of problem solving and handling, promote the practice and standards of information security risk assessment technology to improve constantly, and improve the level of information security risk assessment service capacity building.

Key words: risk assessment, service qualification authentication, information security risk assessment service capability, calculation models, the practice and standards of information security risk assessment technology