Effective risk management begins with a thorough and continuously maintained understanding of the environment that the security program is designed to protect. Without accurate knowledge of the organisation’s physical and digital assets, the processes those assets support, the relationships between them, and the vulnerabilities they carry, risk assessments become speculative exercises and control decisions become disconnected from operational reality. The disciplines described in this section provide the foundational environmental awareness on which every other element of the security program depends, and they must be treated not as one-time discovery activities but as ongoing governance commitments that reflect the organisation’s environment as it actually exists rather than as it was documented at a point in the past.
Establishing Knowledge of the Environment #
The starting point for environmental understanding is a comprehensive and accurate inventory of the organisation’s assets, both physical and digital, and a clear mapping of the relationships between those assets and the business processes they enable. This inventory is not simply an IT asset management exercise. It is a security governance instrument that connects technical infrastructure to business value, enabling the security program to prioritise its risk management activities based on what matters most to the organisation rather than what is most technically visible.
The asset inventory and environmental mapping should address three principal domains, each of which contributes distinct and essential information to the security program’s risk and control management activities.
Server and Application Infrastructure #
The server infrastructure assessment should capture the number and roles of servers within the environment, the network protocols in use, and the applications hosted on each server. This information provides the foundation for understanding where sensitive data resides, which systems support critical business processes, and which components of the infrastructure represent the highest-value targets for adversaries. It also establishes the baseline against which configuration changes can be tracked and unauthorised modifications identified.
Network Infrastructure #
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
