FISASCORE® is a comprehensive information security risk assessment designed to discover and quantify information security risk. An industry standard utilized by security practitioners around the country, FISASCORE builds effective information security programs and provides organizations with the data necessary to prioritize and maximize information security investments.Connect with a Cybersecurity Specialist
Quantification of risk also provides the pivotal common language for security practitioners and executives to speak about risk. This allows organizations to set risk tolerance thresholds and eases the process of determining how much money to spend.
FISASCORE matches the requirements to many different standards including HITRUST, ISO 27000-1, NIST CSF, FFIEC, NCUA, GLBA, FISMA
FISASCORE consists of a thorough evaluation of risks within four phases: Administrative Controls, Physical Controls, Internal Technical Controls, and External Technical Controls:
Sometimes referred to as the “human” part of information security and are controls used to govern other parts of information security.
The security controls that can often be touched and provide physical security to protect your information assets.
The controls that are technical in nature and used within your organization’s technical domain (inside the gateways or firewalls).
These are technical in nature and are used to protect outside access to your organization’s technical domain (outside the gateways or firewalls).