Report | Information Systems homework help

You have been hired to help a small retail company with their risk management program.
Below are some specifics about the company:

1. The company consists of 30 employees spread across 3 locations in Denver
(USA), Quebec City (Canada), and Nice (France).

2. The company has retail locations in Denver and Nice along with an online
presence (serving the US, Canada, and Europe). A small product design team is
located in Quebec City.

3. The three locations are connected to each other via VPN connections using
the Internet. The main hardware (very small data center) is located in the
Denver office. They do not currently have a backup/redundant data center.

4. The company currently has 2 full time IT professionals (Denver and Nice).
These professionals would be responsible for managing the company’s IT risk
management program.

5. The company is required to comply with PCI-DSS, California Consumer
Privacy Act (CCPA), General Data Protection Regulation (GDPR), and the
Personal Information Protection and Electronic Documents Act (PIPEDA)

Your task is to create a report for the company that identifies some of the key
components of risk management and addresses their current concerns. Take into
account the items above, along with the concerns identified below:

1. Risk management is fairly new to the company, make sure to fully
define/describe the concepts the rubric is looking for.

2. Create a risk register using the 3 risks below and include the following
information:

 Risk description – Information about the risk itself,
including relevant threats, vulnerabilities, and
consequences

 Affected assets – Information about assets or asset groups
that are affected by the risk (you can generalize this
somewhat as you don’t have many specific details)

 Risk score – Information about the probability and impact
of threat occurrence, expressed in qualitative terms (Low
– Medium – High)

 Risk treatment analysis – Information about the potential
impact of various risk treatment options

 Risk treatment – Information of risk treatment you suggest
the company should implement and why (citing other
companies/examples can help with this)

o Three risks have been identified by the company as pressing issues:
1. Potential for a data breach of sensitive customer

information located on various (electronic) company
resources.

2. Potential for a disruption to the physical retail locations
where customers would not be able to visit or make
purchases from these 2 locations.

3. Potential for a catastrophic disruption at the Denver
location which would render the data center unavailable,
causing an interruption to all locations, including the
online presence.

3. The company has noticed an increase in phishing emails and is worried about
malware. Using the scenario of malware install via a phishing email, create an
incident response playbook by using the phases/steps of security incident
response (chapter 5) describing what each phase is and the activities that
would occur for the company in this scenario.

4. Some aspects of a full risk management program may be out of the
scope/knowledge for the company to manage internally. Research 3
companies that provide IT risk management/security program management
services that can assist the company. Make sure to include for each:

o Company name, location, website (should be in the US as that is
where the main company data center is located)

o Summary of services provided
o Reason why you are proposing this company as an option (can

include current customers to help validate)

Guidelines:

Minimum 8 pages not including �tle and reference pages.

At least 8 references

Need Turni�n and AI Report