MyMIS (g) physical security; (h) communication networks; (i) legal issues; (j) functional owners; and (k) system users. 2.3.2 Identification of Risks and Threats Identifying risks and taking action The identification of risks and threats is a critical step towards securing ICT assets. The result of the identification will dictate further activities and the channelling of resources, which consists of funding, training efforts and future planning. Hence, the proper planning of this activity cannot be overemphasised and should focus on avoiding core business shutdown or, at the least, minimising disruptions. Unauthorised disclosure will cause embarrassment In the public sector, unauthorised disclosure may result in embarrassment where the risk may not be quantifiable in terms of monetary loss. In identifying the risks and threats, the ICTSO in consultation with the Chief Information Officer (CIO) and administrators will need to: (a) review the value of the information contained in their systems or information that could be derived from their information systems. Once this is done, the value attached to the ICT assets can help determine the level and types of risks that can or should be tolerated; CIOs and the ICTSO need to discuss the risks and threats (b) determine events or combinations of events that could disrupt business operations. Admittedly, this is rather difficult to implement since the list could be endless. However most risks are visible and can be easily listed. Examples are physical sites, access controls, power supplies, environmental controls, etc.; and (c) establish the priority to the risk elements identified. Some risks can have low priority whilst others are categorised as high priority risks. There is no rule to establish this, as risks are interpreted differently by agencies according to differing perceptions about the level of disruption or damage. In this light, the management may want to attach an association between risks, its potential disruptive ability and the cost of reconstruction. The methods employed for identification of risks and threats may be formal (user observation reports), informal (corridor talk), quantitative or qualitative or a combination of these methods. 2.3.3 Evaluating risk through analysis of data and information Copyright MAMPU Evaluation of Risks and Threats Once identification of risks and threats is completed, the process evolves towards risk evaluation, which involves the collection and analysis of data. There are many sources of information that can be used to conduct this exercise. Since information sources can be numerous, steps should be taken to screen and analyse the data. This can be performed by focusing on areas Chapter 2 - 6