In every case, the risk to the organization must be reduced to an acceptable level. Here are some of the potential risks:
- Failure of the security solution to accomplish objectives
- Presence of residual security risks not addressed by the proposed solution
Risks need to be properly identified, evaluated and addressed. The impact of these risks can be minimized by proper project management and control of the implementation process. It is important to note that risks are events, not issues, and the probability of occurrence and estimated business impact, should be calculated and documented.
Business Case Recommendations
For security solution implementations, business case recommendations must be presented to describe the justification for the recommendations, clearly put forth to enable readers at all levels of the organization to quickly understand the extent of the investment the nature of the product, service or resources which will provide the solution.