Last updated on: March 18, 2025
A recent report found that in the past years, 75% of organizations had to change their cybersecurity approach. While organizations have pushed the digital frontiers, they are now in the crosshairs of more threat actors than ever. How should an organization react?
There are multiple ways to manage your defenses, and one of them is IT risk management. This starter guide will help you understand IT risks and the importance of measuring and managing them in a growing business.
What is an IT risk?
IT risks are the vulnerabilities and threats that arise from within the IT infrastructure that can negatively impact a business. The negative impact could be a monetary loss, compromise of customer data, halt in operations, compliance violations, or even a hit on brand reputation and goodwill.
Formally, the IT risks can be categorized into four aspects.
i) Security, such as unauthorized access of business-critical data.
ii) Availability, such as an outage of a key infrastructure component.
iii) Performance, such as poor network speeds leading to loss of productivity.
iv) Compliance, such as adhering to GDPR laws or incurring heavy penalties from failing to do so.
An IT risk under each of these categories occurs from three components.
Risk = Threat x Vulnerability x Asset
An asset is considered any IT resource with valuable information. It could be a business-critical server or a person or a team managing the critical server. Any considerable value-adding component in the IT supply chain is considered an asset.
Vulnerabilities and threats are two sides of the same coin. A vulnerability can be an organization process gap, an oversight in asset design, bugs in the software code, or a lack of knowledge among employees. In the end, vulnerabilities are weak points in an organization that can be exploited to cause damage.
Threats are the potential for malicious agents to exploit a known or an unknown vulnerability. The threats can be internal, disgruntled employees disrupting the business or an external hacker injecting a malicious agent into the supply chain.
So an IT risk is a combination of the probability of a threat and the potential impact of the vulnerability for the number of assets involved for that specific vulnerability.
While IT risk calculation seems like a data-backed quantitative value, in practice, organizations often use qualitative ratings. Often times, it is impossible to fix a tangible value or a probability for IT risks specific to an asset, threat, or a vulnerability. For instance, the probability of a threat actor accessing a remote employee's workstation when connected to an unsecured network cannot be accurately quantified.
Therefore, the goal of an IT risk analysis is to identify and prioritize the risks that organizations face, so they can be neutralized in the order of urgency.
The importance of IT risk management in 2024
IT infrastructure has changed for businesses across all industries. The cloud has become popular among organizations, BYOD policies are prevalent, implementing cybersecurity practices is a high priority, and the risk of enterprise AI looms large.
With so many organizations going through digital transformation, the IT risk factor has multiplied along with it. It is no surprise that 84% of the organizations without a systematic approach to risk and compliance efforts faced an IT supply chain disruption with their server, network, or their IT management software in the last 24 months.
And now, with the advent of AI-powered productivity, organizations are further exposing themselves to new risks, such as confidential corporate data being leaked by ever-learning LLMs. In fact, a survey report states that 61% of organizations are concerned about the business risks that can arise from using generative AI in their operations.
So implementing a formalized approach towards IT risk management, with an overarching governance, risk, and compliance (GRC) strategy, organizations can significantly immunize their operations from disruptions.
Key benefits and real-life examples of IT risk management
Improved infrastructure availability
Thorough risk management of the IT infrastructure involves mapping its potential failure points and establishing a continuous maintenance and upkeep of its functionality.
Case in point: In January 2023, the Federal Aviation Administration (FAA) faced a system outage that led to thousands of airlines being grounded for several hours. The failed system was called the 'Notice to Air Missions (NOTAM) database, which all pilots must check before takeoff for any runway closures. The NOTAM is a legacy system and was a critical point of failure. A proper risk management process would have resulted in either upgrading the system or adding additional checks to maintain its service availability.
Better control over brand reputation
A loss in business productivity can have a cascading effect. A major loss in productivity that affects the business's customers further erodes goodwill.
Case in point: Delta Airlines had an impressive record of having the lowest rate of cancelled flights in the USA and built up a reputation of reliability. However, in 2016, an organization-wide outage led to the cancellation of over 1,500 Delta flights, leading to thousands of passengers spending the night in the airport. Its reputation of reliability took a hit as stranded travelers began posting the problem on X (formerly Twitter), making #Delta a top trending topic, garnering negative attention from around the world. These are IT infrastructure availability risks caused due to a power outage that wasn't mitigated through a fallback plan, thus leading to operational failure on a massive scale.
Foster innovative initiatives
When risks and uncertainties that cannot be avoided or eliminated are determined and clearly communicated to employees, your organization can develop unique solutions to ensure productivity doesn't take a hit. Employees can use these solutions with confidence, since they're designed to accommodate the communicated risks.
Case in point: The Department of Veteran Affairs (VA) manages one of the largest integrated hospital networks in the USA. To leverage state-of-the-art technologies such as AI for its patients while mitigating the risk of compromising confidential health data, the VA has launched its Cyber Innovation Program (CIP). Through the CIP, the VA's technology team pilots new systems such as using VR headsets for medical analysis, simulated and tested in an external environment, and then gradually introduces them into the VA's system. The CIP serves as a testing ground to weed out any IT risks, ensuring veterans do not face any friction once an initiative is launched.
Sharper decision making
IT risk management essentially formalizes the vulnerabilities, threats, and weak points of the IT infrastructure. Subsequently, it offers IT leaders a structured approach to decision-making on its strategy and operations. With clearly defined risk factors, stakeholders can extrapolate to hypothetical situations and debate the efficiency of new initiatives before implementing them.
Case in point: The Bank of New York Mellon established an AI model to predict and reduce the risk of transactions in the treasury market that would fail to settle. The risk prediction model helped its digital banking team predict about 40% of settlement failures.
How does IT risk management interact with other ITSM practices?
Since the goal of IT risk management is to ensure the confidentiality, integrity, and availability of the IT infrastructure, it is closely related to availability management, IT service continuity management, and information security management.
Availability management (AM) focuses on achieving the current applications and services requirements of the organization and setting up plans to scale up for future demand. As part of risk management, availability risks that surface as outages are recorded and managed. Further, when these risks surface, they are managed as incidents and problems.
IT service continuity management (ITSCM) deals with maintaining service availability and performance, but during and after disasters. Naturally, the process involves assessing the risks, analyzing them, and mapping the risks that could severely impact the IT services and applications.
Finally, information security management (ISM) manages the risks associated with the confidentiality and integrity of the organization data. Similar to other practices, the potential risks to sensitive data such as PII, health information, or financial data, are mapped using standardized risk assessment techniques, and they are neutralized using various risk management strategies.
The process behind an effective IT risk management
IT risk management falls under the purview of the GRC division of an enterprise. Therefore, as part of GRC activity, every risk management process involves a few common steps.
1. Identify your organization's risks and vulnerabilities
IT risks depend on the size of your business, the industry, and the types of applications and services supported. Risk identification is going to be different for an IT shop managing a retail chain when compared to an IT division managing a global hospital network.
For the retail shop, the risk would pertain to payment processing system or their inventory system, whereas a multi-national healthcare center would face risks with securing patient health information, their email servers, medical systems, and more.
There are multiple methods to begin the risk identification process, such as strengths, weaknesses, opportunities, and threats (SWOT) analysis, assumption analysis, affinity diagrams, or a simple employee feedback system.
2. Classify and assess the identified risks
Once the risks are identified, they can be categorized to assess them effectively. Typically, risks to the IT systems can be classified as external, internal, deliberate, or unintentional. Or they can be classified based on the impact, such as service continuity, security, brand reputation, or revenue.
Once categorized, the methodology to assess the risk depends on its type. If it is a quantitative risk, it would be assessed and measured in monetary terms. For instance, if the risk is regarding server failure, a quantitative measurement would include the cost of the server, an estimate of revenue loss per minute with the server outage, the historic frequency of its outage, and other similar parameters.
On the other hand, qualitative measures of IT risk are determined through judgment and opinions, and these risks are based on probabilistic outcomes.
Once the risks are assessed, they are added to the risk assessment matrix.
3. Set up mitigation measures
With the assessment done, begin implementing measures to neutralize the risks. These IT risk controls can be additional security layers, stringent policies, or even outsourced to external agencies. It is also considered a best practice for organizations to opt for cyber insurance once an IT risk management plan is in place.
To mitigate the risk related to unauthorized access to critical servers, data centers, and data storage levels, install biometric scanners to filter access. Mitigation strategies are proactive in nature. They are implemented to reduce the likelihood of identified risks from occurring in the organization.
4. Develop a response plan
The response plan kicks in when the organization faces a risk despite mitigation efforts. It is the reactive approach to managing IT risks. For instance, IT outages would be documented as a risk, and despite measures to mitigate it, when an outage occurs, the major incident response plan kicks in.
The goal of the response plan is to curtail incidents before they worsen, to ensure critical business functions are continued despite the incidents, to find the root-cause of the incident, and to ensure such incidents do not occur in the future.
Incident management and problem management practices intersect with the activities associated with responding and mitigating IT risks in an organization.
5. Continuously monitor and identify new risks
Finally, a feedback system is required to continuously monitor any documented IT risks and identify new ones that may arise when organizations scale up. IT systems have sophisticated monitoring and observability platforms that continuously monitor the infrastructure for any potential malfunctions or threats. The platforms monitor an extensive range of events and telemetry data; and activities, such as user access logs, RAM usage, network bandwidth usage, temperature, and much more, can be showcased on an IT risk dashboard to help IT teams infer risks better.
These continuous monitoring systems also open up the possibility to predict future occurrences from historic data. Currently, with AI models, unstructured telemetry data can be evaluated to derive insights and extrapolate patterns from past incidents. Any new risk that is identified from these monitoring systems goes through the entire process of risk management again, thereby creating a cycle.
The commonly used IT risk management frameworks
There are numerous IT risk management frameworks (RMF) depending upon the industry standards and requirements. An IT RMF offers a standardized structure and workflow for IT teams to base their policies, risk mitigation measures, and monitoring systems on.
Here are few popular IT risk management frameworks:
| Frameworks | Publishing organization | About the framework |
|---|---|---|
|
ISO 27001 and ISO 27002 |
The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) |
To establish controls to mitigate information security risks from unauthorized access and cyberattacks |
|
NIST 800-53 and NIST CFS |
National Institute of Standards and Technology, USA |
To secure the information systems that store and transmit government data |
|
AICIPA and SOC 2 |
American Institute of Certified Public Accountants |
To mitigate security lapse risks on customers' data The framework operates on five principles: confidentiality, availability, integrity, privacy, and security |
|
Expression des Besoins et Identification des de Sécurité (EBIOS) |
French Cybersecurity Agency (ANSSI), France |
A cyber risk management framework that focuses on information security, prevalent among French public agencies |
|
Cybersecurity Maturity Model Certification (CMMC) |
National Institute of Standards and Technology, USA |
To enforce contractors and subcontractors for the US government to align with information security standards |
|
OCTAVE Allegro |
Carnegie Mellon University (CMU), for the United States Department of Defense |
A self-directed risk assessment methodology that focuses on mitigating ITOps risks The methodology is geared toward small organizations with a handful of IT team members and is a perfect starting point in the risk management journey |
|
FAIR IT risk management |
Jack A. Jones, FAIR Institute |
A quantitative methodology that assess risks in monetary terms |
Common approaches towards managing IT risks
There are four types of approaches to managing IT risks, and each approach can be used on the type of risk to be mitigated, the culture of the organization, and the risk management strategy.
Avoiding risks altogether: IT teams can completely avoid taking up certain risks, such as collecting customer's location data when accessing the business' services. While data is pertinent for the enterprise to function, the IT teams can choose to avoid taking on the risk of secure collection and storage of such sensitive data. While IT risk management as a whole aims to manage the identified risks, the risk avoidance tactic just eliminates the unnecessary risks for a business to operate efficiently.
Reducing the likelihood of risks: These are the mitigation tactics used to reduce the likelihood of an identified risk occurring in the organization. A simple example would be the usage of an ITOps monitoring system to proactively gauge any network or server outage in the organization.
Retaining risks: Risk retention is accepting the risks that the enterprise faces. This is similar to risk avoidance, where no action is taken as a counter-measure for the exposed vulnerability. This approach is taken when the probability of the risk occurring is highly unlikely, and the resources required to mitigate the risk are too high. For instance, if legacy systems aren't connected to the internet and don't hold any business-critical or sensitive data, the organization faces low risk but high costs to upgrade them. They can choose to simply accept the risk.
Sharing or transferring risks: Risk transference is when the organization collaborates with an external vendor or another organization to outsource the management of the risk. A common example of organizations transferring IT risks is contracting MSPs for their IT processes. While this approach shifts the liability towards the MSPs, the organization still would have to assess and analyze the third-party risks with the transference. Another frequent risk transference in IT departments is when cyber insurance providers take up the monetary risks of the organization in the case of cyberattacks.
IT risk management
best practices
Begin the journey with a base framework: In case your organization is just starting on its IT risk management journey, a good rule of thumb is to try to set up any industry standard as the baseline, and then build on top of it as the organization matures in understanding the risk management process and benefits. Generally, organizations begin with a popular framework such as the NIST 800-53 or the ISO 27001.
Frequent evaluation of IT risks: IT departments need to take an always-on approach to evaluating risks. The IT infrastructure is consistently changing, and the threat landscape is also constantly developing innovative methods to penetrate defenses. Further, it is equally important to validate the risks that are evaluated. The best practice is to produce documentation validating the answers and ensure answers are approved by internal stakeholders.
Set up policies with the leadership vote of confidence: Often times, when employees are educated or given guidelines on the do's and don'ts regarding IT risk, it can lead to partially successful compliance, where only some employees follow the guidelines. The best practice is to start from the top: get the C-suite to buy in and establish concrete IT risk management policies. With these policies in place, it's easy for employees to adhere to them and maintain accountability.
Maintain a stringent vendor risk assessment: Your IT infrastructure and data can face risks from external stakeholders, such as the vendors your organization depends on. It is imperative to do a thorough analysis of the vendor with an exhaustive list of questions and documentation to validate their claims. Keep a tight contract with exact verbiage that cannot be misinterpreted, and convey the expectations around the incident response timelines, reporting, offshore data access, service level objectives (SLOs), and service level agreements (SLAs).
Factor in organization scalability: If your organization is in a growth phase, the risk management strategy cannot be revamped every year to account for the changes. Ensure you have established a risk management strategy that can factor in growth agents such as the range of new threats, the growth of suppliers, or the change in employee count. A few examples of planning for scalable risk are setting a process to analyze any new technology before being used in the organization and choosing software that an organization can use for the next few years.
IT risk management checklist
When you are getting started on your IT risk management strategy and assessment, it is easy to miss some best practices, which can creates a challenge later. So we drafted a short checklist to help you keep things on track!
- Is the IT risk management process tailored to the organization's culture?
- Is it possible to establish communication with external and internal stakeholders during the risk assessment process?
- Does the C-suite view cybersecurity and risk mitigation as a business-critical component?
- Has the organization determined the level of IT risk with which they can operate every day?
- Does your organization have a CISO?
- Can the CISO or any authoritative entity enforce the IT risk management policies?
- Has your IT risk management strategy accounted for the short-term and long-term objectives of the organization?
- Is there a framework in place for business units to identify, measure, monitor, and control the IT risks they face?
How does ServiceDesk Plus boost IT risk management efforts?
An ITSM platform helps streamline IT service delivery, which includes managing incidents, identifying problems, tracking hardware assets and software compliance, and other practices. The nature of these practices complements IT risk mitigation and risk monitoring processes. For instance, if any identified risk—such as a cybersecurity threat—occurs, the incident response workflow would kick in as part of incident management efforts.
ServiceDesk Plus, the unified service management platform from ManageEngine, accelerates risk mitigation with its automated incident response workflows. Any alert raised from the IT infrastructure triggers the incident workflows, which would break collaboration barriers by automatically sending out notifications to the relevant technicians.
When a new vulnerability in the IT environment is identified and classified as an IT risk, ServiceDesk Plus can help find the root cause of it to eradicate it from the IT environment with the Problems module. You can also manage a known error database in ServiceDesk Plus to classify known vulnerabilities.
Another major area of high risk probability is the hardware and software used in the organization. As an ITSM platform, ServiceDesk Plus can discover, classify, and track hardware such workstations, servers, routers, and more. The Assets module in ServiceDesk Plus can also track software, identify its usage, and showcase the license compliance status of all software in use, reducing the risk of missing assets and non-compliance to software.
The CMDB in ServiceDesk Plus offers a visual map of the IT infrastructure and the relationship each component holds between between them. IT admins can modify and track the IT infrastructure as it scales up. IT risk managers can continuously update the risk profile as new components are added to the IT infrastructure. With the relationship map, IT risk managers can also infer the impact of any downtime of any IT component.
If you would like to revamp your IT service management to improve your GRC posture, try ServiceDesk Plus for 30 days, no questions asked. Or you can schedule a demo, during which our product experts will configure ServiceDesk Plus to your needs and showcase it.
Author's bio
Zephaniah is a product marketer for ManageEngine's ESM suite of products. He loves creating resources to educate IT service desk folks on the best practices for making the most of ITSM. Some of these resources include self-assessment toolkits, security-first service management framework, detailed guides, several blogs, and more.
He is an active participant in various industry conferences across mediums, such as the SupportWorld Live (USA), and events from both SDI and SITS (UK). Zephaniah is also a frequent presenter in ManageEngine IT conferences held worldwide.
