IT RISK MANAGEMENT DEVELOPMENT IN ORGANISATIONS

Abstract

The aim of this thesis is to consider organisational IT risks, information security, risk processes and the practises related to the risk assessment. The theoretical part handles IT risk assessment, information security and IT leading.

The thesis is a developmental process where company risk concerns related to the IT functions are investigated. In practise the risk and network security checks were made. Based on the results, risks and threats can be defined, and needed guidelines and evaluation methods can be created.

Based on the results it is meaningful to develop the IT guidelines and create policies, best practises and lists which are related to IT risks. There should be regular follow up methods for IT risks in the future and IT functions should be regularly audited based on the risk lists. The development work continues after this thesis, and the risk evaluations are meant to develop further. For the future the company should develop a security plan, a security policy and a continuity and recovery plan.