IT risk management process
IT風險管理流程

In business, IT risk management entails a process of identifying, monitoring and managing potential information security or technology risks with the goal of mitigating or minimising their negative impact.

Examples of potential IT risks include security breaches, data loss or theft, cyber attacks, system failures and natural disasters. Anything that could affect the confidentiality, integrity and availability of your systems and assets could be considered an IT risk.

Steps in the IT risk management process
To manage IT risks effectively, follow these six steps in your risk management process:
在業務中，IT風險管理需要識別、監控和管理潛在的信息安全或技術風險的過程，以減輕或盡量減少其負面影響。

潛在的IT風險包括安全漏洞、數據丟失或被盜、網絡攻擊、系統故障和自然災害。任何可能影響您的系統和資產的機密性、完整性和可用性的行為都可能被視為IT風險。

IT風險管理流程的步驟
要有效管理資訊科技風險，請在風險管理程序中遵循以下六個步驟：

1. Identify risks
   Determine the nature of risks and how they relate to your business. Take a look at the different types of IT risk.

2. Assess評估 risks
   Determine how serious each risk is to your business and prioritise them. Carry out an IT risk assessment.

3. Mitigate減輕 risks
   Put in place preventive measures to reduce the likelihood of the risk occurring and limit its impact. Find solutions in our IT risk management checklist.

4. Develop an incident response
   Set out plans for managing a problem and recovering your operations. Devise and test your IT incident response and recovery strategy.

5. Develop contingency應急 plans
   Ensure that your business can continue to run after an incident or a crisis. Read about IT risk and business continuity.

6. Review processes and procedures程序
   Continue to assess threats and manage new risks. Read more about the strategies to manage business risk.

7. 識別風險
   確定風險的性質以及它們與您的業務的關系。來看看不同類型的IT風險。

8. 評估風險
   確定每種風險對您的業務的嚴重程度，并對它們進行優先級排序。進行IT風險評估。

9. 減輕風險
   落實預防措施，降低風險發生的可能性，限制其影響。在我們的IT風險管理清單中查找解決方案。

10. 制定事件響應
    制定管理問題和恢復操作的計劃。設計并測試您的IT事件響應和恢復策略。

11. 制定應急計劃
    確保您的業務在發生事件或危機后仍能繼續運行。了解IT風險和業務連續性。

12. 審評進程和程序
    繼續評估威脅和管理新的風險。關于管理業務風險的策略。

IT risk controls
As part of your risk management, try to reduce the likelihood of risks affecting your business in the first place. Put in place measures to protect your systems and data from all known threats.

For example, you should:
信息技術風險控制
作為風險管理的一部分，首先要努力降低風險影響業務的可能性。采取措施保護您的系統和數據免受所有已知威脅的侵害。

例如，你應該：

Review the information you hold and share. Make sure that you comply with data protection legislation, and think about what needs to be on public or shared systems. Where possible, remove sensitive information.
Install and maintain security controls, such as firewalls, anti-virus software and processes that help prevent intrusion and protect your business online.
Implement security policies and procedures such as internet and email usage policies, and train staff.
Use a third-party IT provider if you lack in-house skills. Often, they can provide their own security expertise. See how to choose an IT supplier for your business.
If you can’t remove or reduce risks to an acceptable level, you may be able to take action to lessen the impact of potential incidents.
查看您持有和共享的信息。確保您遵守數據保護法規，并考慮在公共或共享系統中需要什么。盡可能刪除敏感信息。
安裝和維護安全控制，如防火墻、防病毒軟件和流程，幫助防止入侵和保護您的在線業務。
執行安全政策和程序，如互聯網和電子郵件的使用政策，并培訓員工。
如果缺乏內部技能，請使用第三方IT提供商。常情況下，他們可以提供自己的安全專業知識。了解如何為您的企業選擇IT供應商。
如果您無法將風險消除或降低到可接受的水平，您可以采取行動來減輕潛在事件的影響。

Mitigate IT risks
To mitigate IT risks, you should consider:

setting procedures for detecting problems (eg a virus infecting your system), possibly with the help of cyber security breach detection tools
getting cyber insurance against the costs of security breaches
You can also use the National Cyber Security Centre’s (NCSC) free Check your cyber security service to perform a range of simple online checks to identify common vulnerabilities in your public-facing IT.

The NCSC also offer a free Cyber Action Plan. By answering a few simple questions, you can get a free personalised action plan that lists what you or your organisation can do right now to protect against cyber attack.
降低IT風險
要降低IT風險，您應該考慮:

設置檢測問題（如病毒感染您的系統）的程序，可能需要網絡安全漏洞檢測工具的幫助
針對安全漏洞的成本獲得網絡保險
您還可以使用國家網絡安全中心（NCSC）的免費檢查您的網絡安全服務來執行一系列簡單的在線檢查，以識別面向公眾的IT中的常見漏洞。

NCSC還提供免費的網絡行動計劃。通過回答幾個簡單的問題，您可以獲得一份免費的個性化行動計劃，其中列出了您或您的組織現在可以采取哪些措施來抵御網絡攻擊。