Introduction

In this chapter, we cover the basic activities that must be accomplished to complete the Organizational Information Criticality Matrix (OICM). The OICM is based on customer decisions about the information types within their own organization that are critical for the completion of their mission and meeting organizational goals. The activities we cover in this discussion include:

• Identifying the critical information at the customer organization

• Identifying the mission of the customer organization

• Creating impact definitions

• Creating the OICM

• Determining the high-water mark for the OICM

Defining an organization s information criticality is one of the most important steps in the IAM assessment process. This process gives the customer a clear understanding of how their own organization operates and what information should be protected. These activities typically represent the first in-depth interaction between the assessment team and the customer. The customer should know they are in control of the assessment process and that they have the final word on the outcome of the assessment. The decisions they make will directly impact the quality of the final report your team delivers at the end of this project. The assessment team should not make these decisions because that often would require the team to make assumptions about how the customer organization conducts business and what their business goals are. In the world of commercial security assessments, poor assumptions on the part of the security consulting firm could result in a liability to the customer should a security incident occur.

Instead, the assessment team leader...