Analysis of level II risk in a 3-layer hierarchical model of information security management, taking into account characteristics of public statistics

Abstract

We present a proposal for including characteristics of public statistics as a precondition of validity for any level II risk analysis based on a 3-layered model of information security in a national statistic organization with hierarchical-networking corporate structure. 3-layered model is proposed using the TISM methodology. The risk analysis can be based on corporate resources or all business processes within the organization related to its security. In case of lack of a mapping of relationships between processes, there is a possibility of an imperfect substitute in the form of an analysis of specifics of organisational functions, which groups some processes by their characteristics. An example is given to illustrate utilization of the characteristics of public statistics in level II risk analysis.