12560 evsjv‡`k †M‡RU, AwZwi³, GwcÖj 6, 2014 9. Risk, Threats and Vulnerabilities (1) While formulating a security policy every organization or agency should be aware of possible risks that can affect the safety and security of their information asset. The organization or agency should also have clear understanding about threats and vulnerabilities that could damage its information assets. For appropriate safeguard of information assets knowledge about risks, threats and vulnerability is vital. This section will assist an agency to understand and identify and analyze threats, risks and vulnerabilities. (2) Understanding Risk, Threat and Vulnerability (a) Risk The potential (merely “chance”) for loss, damage or destruction of an information asset as a result of a threat exploiting a vulnerability. Reducing the risk of an organization requires risk identification and risk management process to be done periodically. An agency should know major risks that may cause potential loss of their information asset. Reasons for major risks/weaknesses are: a. little support for security measures, b. information is not classified, c. inadequate information security policy operates, d. lack of security awareness are there, e. weak access control mechanisms exists, f. no official policy and no monitoring/intrusion detection or no incident response team are in place, g. Operating procedures are not documented, h. Employees are not identified adequately, visitors may roam unchecked, i. The building is in an earthquake zone; j. The building is in a flooded zone or can be affected by flood because of improper water disposal system, k. Lack of fire prevention system, etc.