IT risk management framework and methods

Abstract

A method for treating information technology (IT) risk of an organization including identifying a plurality of IT risks, where each of the plurality of IT risks is based on a known problem and is associated with an IT asset classification and an IT consequence classification, calculating a plurality of IT risk exposure indices, where each of the plurality of IT risk exposure indices is associated with at least one of the plurality of IT risks, adjusting each of the plurality of IT risk exposure indices based on a business impact factor to obtain a business impact index, prioritizing the plurality of IT risks by adjusting the business impact index based on a risk treatment factor to obtain a prioritized risk treatment index, and selecting at least one of the plurality of IT risks for treatment based upon the prioritized risk treatment index.

Dependencies are inferred from the claim text.