GRC Access control - access risk level definition

[Tiberius]

Is there a document outlining the definitions of the access risk levels.

I am interested in all levels: low, medium and high and what makes the classification to one versus another.

Thanks,

[madhusap]

Hi Busu,

A risk rating is the measure of the impact of an irregularity related to access risk. We rate risks based on the impact to the process or business and then decide on how to handle them based on the risk rating.

There is no single definition for risk ratings but generally the following are some recommended guidelines:

HIGH - Any risk having financial or reputational impact or can lead to compromising CIA (Confidentiality, Integrity and Availability) of the system can be considered under this category. No mitigation will be allowed for these kind of risks.

MEDIUM and LOW - Any risk which can have operational impact but can be mitigated with compensating controls

Regards,

Madhu

[former_member230681]

Hi Madhu ,

Thanks for sharing knowledge about risk levels. GRC Ruleset has 4 types of risks,"Critical", "High","Medium" and "Low". Could you also mention recommended guidelines (definition) for Critical risks.

Thanks

Anika