ABSTRACT
One of the final products of the risk assessment is to develop programs to minimize risk to your company and assets. Evaluating threats, capabilities, and risk, along with determining likely methods of attack, does not serve the objective of reducing risk if your company is unwilling to address incidents that will occur within your company’s footprint. If the building is burning around you and your threat assessment had outlined a likely attack from an external threat involving an arsonist, you have to have developed measures to reduce the risk of the identified threat. If not, a curt “I told you so” is the only satisfaction that you will have as your company’s assets burn.
