Object-oriented method, system and medium for risk management by creating inter-dependency between objects, criteria and metrics

A computing system configured to:

• identify a plurality of assets of the organization, wherein each asset is defined to be one of an electronic asset type and a location asset type, wherein the electronic asset type includes computers and networking equipment therefore and the location asset type includes physical locations where the electronic asset types are placed, and store the identified assets into a database;
• identify a plurality of criteria, each criterion defining a security objective of the organization;
• identify a plurality of inventoried assets that relate to each identified criterion;
• and
• formulate one or more metric equations for each identified criterion, each metric equation being defined, in part, by the one or more identified assets, wherein each metric equation yields an outcome value when one or more measurements are made relating to the identified assets, thereby allowing a user to assess the risk to the organization based on the measured values of the one or more metric equations.

A computer readable medium including instructions being executed by one or more computers, the instructions instructing the one or more computers for assessing and/or managing risks for an organization, the instructions comprising implementation of the steps of:

• (a) inventorying a plurality of assets of the organization, wherein each asset is defined to be one of an electronic asset type and a location asset type, and wherein the electronic asset type includes computers and networking equipment therefor and the location asset type includes physical locations where the electronic asset types are placed;
• (b) identifying at least one criterion defining a security objective of the organization;
• (c) identifying one or more inventoried assets that relate to the identified criterion;
• and
• (d) formulating one or more metric equations for each identified criterion, each metric equation being defined, in part, by the one or more identified assets, wherein each metric equation yields an outcome value when one or more measurements are made relating to the identified assets, thereby allowing a user to assess the risk to the organization based on the measured values of the one or more metric equations.