CRAMM

CRAMM (CCTA Risk Analysis and Management Method) is a risk management methodology, currently on its fifth version, CRAMM Version 5.0.

History

CRAMM was created in 1987 by the Central Computer and Telecommunications Agency (CCTA), now renamed into Cabinet Office, of the United Kingdom government.

Methodology

CRAMM comprises three stages, each supported by objective questionnaires and guidelines. The first two stages identify and analyze the risks to the system. The third stage recommends how these risks should be managed.

The three stages of CRAMM are as follows:

Stage 1

The establishment of the objectives for security by:

  • Defining the boundary for the study for Risk Assessment
  • Identifying and valuing the physical assets that form part of the system;
  • Determining the 'value' of the data held by interviewing users about the potential business impacts that could arise from unavailability, destruction, disclosure or modification;
  • Identifying and valuing the software assets that form part of the system.

Stage 2

The assessment of the risks to the proposed system and the requirements for security by:

  • Identifying and assessing the type and level of threats that may affect the system;
  • Assessing the extent of the system's vulnerabilities to the identified threats;
  • Combining threat and vulnerability assessments with asset values to calculate measures of risks.

Stage 3

Identification and selection of countermeasures that are commensurate with the measures of risks calculated in Stage 2.

CRAMM contains a very large countermeasure library consisting of over 3,000 detailed countermeasures organised into over seventy logical groupings.

Deployment

CRAMM is in use by NATO, the Dutch armed forces, and corporations working actively on security, like Unisys.

CRAMM is offered in English and Dutch versions.

gollark: You can cynically look at this as them trying to make employees develop emotional attachments to the company, too, to make them more exploitable or something.
gollark: I am NEVER working anywhere which randomly overritualizes stuff like this, probably, unless I just forget by the time I actually look for a job, which is likely.
gollark: Obviously what we need is *more* bizarre superstition and stuff. What could POSSIBLY go wrong?
gollark: AAAAAAAAAAAAAA WHY WHY WOULD YOU UNIRONICALLY DO THIS
gollark: Very late correction: Cloudflare was having issues due to some network provider they rely on having issues which affected a bunch of other things too.

References
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.