Introduction

Defining the critical information with the customer, as we just did in Chapter 3, should have allowed everyone involved in the organizational assessment process to better understand how the customer s business operates and the various pieces of information that play a important role in the completion of the customer s mission. To this point, the customer has played a vital role in the assessment process by specifically defining the different critical information types and identifying the organization s mission. They ve also helped by defining the levels of impact that they consider important, relative to their business and industry. All this information has been organized into an easy-to-read matrix that defines (at a high level) the information criticality of the organization.

The next step is just as critical from an assessment point of view because it defines those specific systems that process, transmit, or store the customer s critical information. These are the key information systems that have the greatest impact on the customer s operations. From a technical perspective, these are the systems that will be most focused on during any technical evaluations that occur in conjunction with the IAM assessment process. From a purely organizational perspective, these are the systems that need the deepest scrutiny because the compromise or complete loss of these particular information systems would most likely have a distinct and often painful impact on the organization. As in Chapter 3, the activities in this chapter cannot be completed adequately without the involvement of the customer. We provide some example...