--- title: Ranking Information Security Risk - DueNorth Security description: A better method is to use a point system like what is offered through the S2Score information security risk assessment tool. This allows you image: https://blog.duenorthsecurity.com/hubfs/Imported_Blog_Media/1.webp --- [Skip to content](https://blog.duenorthsecurity.com/blog/information-security-risk-management#main-content) # DueNorth Security Blog Posts Nov 17, 2020 1:30:33 PM # Ranking Information Security Risk [markschlader](https://blog.duenorthsecurity.com/blog/author/markschlader) Share: [facebook-f icon](http://www.facebook.com/share.php?u=https://blog.duenorthsecurity.com/blog/information-security-risk-management) [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://blog.duenorthsecurity.com/blog/information-security-risk-management) [Twitter icon](https://twitter.com/intent/tweet?url=https://blog.duenorthsecurity.com/blog/information-security-risk-management) [pinterest-p icon](http://pinterest.com/pin/create/link/?url=https://blog.duenorthsecurity.com/blog/information-security-risk-management) [envelope icon](mailto:?body=https://blog.duenorthsecurity.com/blog/information-security-risk-management) We have all seen the red, yellow, and green used on information security risk assessments to indicate high, medium, and low levels of risk. It is common with DIY security risk assessment tools used to satisfy HIPAA compliance. It’s time to retire this methodology. Information risk management has matured, and risk mitigation strategies are improving **almost** as fast as threats are evolving. A comprehensive security risk assessment will have hundreds of controls to evaluate. The successive security risk assessment report and risk management plan will therefore have many items to consider for mitigation and may involve multiple people or departments. If a mitigation plan has dozens of high and medium vulnerabilities, it makes it difficult to prioritize what to do first. A better method is to use a point system like what is offered through a few risk assessment tools. This allows you to put together a granular plan and associate resources and timelines to each control implementation. This also allows you to measure your security efforts and show improvements based on every mitigation activity. A point system also makes budgeting for IT and information security easier.  For example, if you spend the money to decommission your Windows 7 computers (that are not receiving security patches and probably have many vulnerabilities) to Windows 10 computers, that would improve your risk score significantly and be reflected in the next assessment. ###### **Measure an ROI for your risk management efforts** Some quantitative assessment tools will also allow you to compare your organization’s security maturity to other organizations of similar size. These tools can also give you an estimated rate of occurrence of a breach based on your score. So, for example, if your security score is a 580 out of 800 possible points, the average rate of a breach would be 5.6 years and the average number of records exposed would be 6%.  If the average cost of a breach for healthcare is $402 per record, you can quickly estimate how much money that breach will cost the organization. Therefore, by improving your score, you are reducing the net number of records exposed due to a breach and saving the organization money.  You can show an ROI for every security remediation effort you put in place. This makes those budget requests a lot easier! Information security risk management has changed a lot since the HIPAA security rule was put into place in 2003. Some security risk assessment methodologies have not changed with the times. There are many ways to utilize the S2Score tool. Organizations can conduct self-assessments for as little as $1,200. These can then be validated by a certified DueNorth analyst for an additional cost. There is also a free risk assessment estimator available [HERE](https://securitystudio.com/duenorthsecurity/). [Uncategorized](https://blog.duenorthsecurity.com/blog/tag/uncategorized) ## Related posts [![](https://blog.duenorthsecurity.com/hs-fs/hubfs/Imported_Blog_Media/S2Org_rgb.png?height=200&name=S2Org_rgb.png)](https://blog.duenorthsecurity.com/blog/free-s2score-estimate) [Uncategorized](https://blog.duenorthsecurity.com/blog/tag/uncategorized) ## [S2Score](https://blog.duenorthsecurity.com/blog/free-s2score-estimate) [markschlader](https://blog.duenorthsecurity.com/blog/author/markschlader) Mar 25, 2019 6:29:46 PM S2Score is a comprehensive, risk-based measurement of information security assigned to your company... [Read more](https://blog.duenorthsecurity.com/blog/free-s2score-estimate) [![](https://blog.duenorthsecurity.com/hs-fs/hubfs/Imported_Blog_Media/Security-risk-assessment.png?height=200&name=Security-risk-assessment.png)](https://blog.duenorthsecurity.com/blog/top-8-security-risk-assessment-findings) [Uncategorized](https://blog.duenorthsecurity.com/blog/tag/uncategorized), [Front Page](https://blog.duenorthsecurity.com/blog/tag/front-page) ## [Top 8 Security Risk Assessment Findings](https://blog.duenorthsecurity.com/blog/top-8-security-risk-assessment-findings) [markschlader](https://blog.duenorthsecurity.com/blog/author/markschlader) May 28, 2019 11:37:32 AM We conduct dozens of security risk assessments for clients each year. It’s not surprising that we... [Read more](https://blog.duenorthsecurity.com/blog/top-8-security-risk-assessment-findings) [![](https://blog.duenorthsecurity.com/hs-fs/hubfs/Imported_Blog_Media/threats.jpg?height=200&name=threats.jpg)](https://blog.duenorthsecurity.com/blog/information-security-threats) [Uncategorized](https://blog.duenorthsecurity.com/blog/tag/uncategorized) ## [4 Types of Information Security Threats](https://blog.duenorthsecurity.com/blog/information-security-threats) [markschlader](https://blog.duenorthsecurity.com/blog/author/markschlader) May 28, 2018 2:37:48 PM No matter how long you have been dealing with HIPAA there are probably some parts you just don’t... [Read more](https://blog.duenorthsecurity.com/blog/information-security-threats) [Learn More on Linkedin](https://www.linkedin.com/company/duenorth-security-llc/) [Learn More on X](https://x.com/DueNorthInfoSec) [![](https://blog.duenorthsecurity.com/hs-fs/hubfs/DueNorth%20-%20IS%20-%20Vertical.jpg?width=1645&height=1473&name=DueNorth%20-%20IS%20-%20Vertical.jpg)](https://blog.duenorthsecurity.com/) Copyright © 2024, ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "markschlader", "url" : "https://blog.duenorthsecurity.com/blog/author/markschlader" }, "dateModified" : "2024-10-23T19:12:55.895Z", "datePublished" : "2020-11-17T19:30:33.000Z", "headline" : "Ranking Information Security Risk - DueNorth Security", "image" : [ "https://blog.duenorthsecurity.com/hubfs/Imported_Blog_Media/1.webp" ], "mainEntityOfPage" : { "@id" : "https://blog.duenorthsecurity.com/blog/information-security-risk-management", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.duenorthsecurity.com/hubfs/DueNorth%20-%20IS%20-%20Vertical.jpg" } } } ```