MyMIS that have the greatest impact on the organisation. The following steps can be adopted in evaluating the risk: (a) quantify the monetary value of a loss by considering these key elements in risk analysis: i. an estimate of the impact or cost of a specific difficulty if it happens; and ii. an estimation of the probability of encountering that difficulty within a period of time; (b) determine the potential economic impact of those risks or events associated with each threat by using the list of vulnerabilities associated with the department’s information assets identified in the previous step; (c) estimate the probability of the undesirable events occurring within a specified period of time (usually one year). Identifying risks and their economic impact does not directly lead to identifying which security exposures are worth corrective action and which are not. Estimating and considering the likelihood or probability of the undesirable events is vital. For example, events such as floods or earthquakes have catastrophic consequences. However, if they appear to have a low probability of occurrence they might not justify protective measures and the decision may be to tolerate the risks; (d) evaluate the suitability of the following options once the monetary value exposure or its annual loss is estimated: i. tolerate the risk; ii. insure against the risk; iii. lower the monetary impact by implementing those measures costing less than the exposure; or iv. lower the probability of the loss occurring by implementing protective measures costing less than the exposure; (e) determine whether security safeguards are needed and if so, allocate the cost. The information gained from this can be used to estimate the annual monetary value of a loss, which subsequently can be used to provide a common denominator for determining the magnitude of each risk. A department may then develop safeguards against the high monetary loss risks; and (f) identify alternative security safeguards and provide recommendations for cost-effective security solutions. 2.3.4 Identify the safeguards– could be additional or removal of ineffective safety measures Copyright MAMPU Identification of Necessary Safeguards Amongst the key elements of Public Sector ICT Security is to identify suitable safeguards. The process of identification could result in acquiring additional safeguards or the removal of ineffective safety measures because both monetary Chapter 2 - 7