Report - The company consists of 30 employees spread

REPORT

You have been hired to help a small retail company with their risk management program. Below are some specifics about the company:

1. The company consists of 30 employees spread across 3 locations in Denver (USA), Quebec City (Canada), and Nice (France).

2. The company has retail locations in Denver and Nice along with an online presence (serving the US, Canada, and Europe). A small product design team is located in Quebec City.

3. The three locations are connected to each other via VPN connections using the Internet. The main hardware (very small data center) is located in the Denver office. They do not currently have a backup/redundant data center.

4. The company currently has 2 full time IT professionals (Denver and Nice). These professionals would be responsible for managing the company's IT risk management program.

5. The company is required to comply with PCI-DSS, California Consumer Privacy Act (CCPA), General Data Protection Regulation (GDPR), and the Personal Information Protection and Electronic Documents Act (PIPEDA)

Your task is to create a report for the company that identifies some of the key components of risk management and addresses their current concerns. Take into account the items above, along with the concerns identified below:

1. Risk management is fairly new to the company, make sure to fully define/describe the concepts the rubric is looking for.

2. Create a risk register using the 3 risks below and include the following information:

? Risk description - Information about the risk itself, including relevant threats, vulnerabilities, and consequences

? Affected assets - Information about assets or asset groups that are affected by the risk (you can generalize this somewhat as you don't have many specific details)

? Risk score - Information about the probability and impact of threat occurrence, expressed in qualitative terms (Low - Medium - High)

? Risk treatment analysis - Information about the potential impact of various risk treatment options

? Risk treatment - Information of risk treatment you suggest the company should implement and why (citing other companies/examples can help with this)

o Three risks have been identified by the company as pressing issues: 1. Potential for a data breach of sensitive customer

information located on various (electronic) company resources.

2. Potential for a disruption to the physical retail locations where customers would not be able to visit or make purchases from these 2 locations.

3. Potential for a catastrophic disruption at the Denver location which would render the data center unavailable, causing an interruption to all locations, including the online presence.

3. The company has noticed an increase in phishing emails and is worried about malware. Using the scenario of malware install via a phishing email, create an incident response playbook by using the phases/steps of security incident response (chapter 5) describing what each phase is and the activities that would occur for the company in this scenario.

4. Some aspects of a full risk management program may be out of the scope/knowledge for the company to manage internally. Research 3 companies that provide IT risk management/security program management services that can assist the company. Make sure to include for each:

o Company name, location, website (should be in the US as that is where the main company data center is located)

o Summary of services provided o Reason why you are proposing this company as an option (can

include current customers to help validate)

Guidelines:

Minimum 8 pages not including ?tle and reference pages.

At least 8 references