Abstract

Two well-known risk management tools, risk maps and failure mode and effects analysis (FMEA), are often used to assess security threats and develop an effective plan to prevent or mitigate risks. Risk maps are developed by identifying the stakeholders in an organization, both human and nonhuman, determining potential threats to the organization, finding the sources of those threats and finally, deciding on the impact those threats will have on the stakeholders. These maps identify areas that make an organization vulnerable and threats that need to be planned for. FMEA works in a similar way, identifying threats, sources, losses, risks and controls for any given failure and focuses on taking steps to prevent a failure or threat.