Abstract

The primary intent of this thesis is to contribute to information risk assessment process conducted in large organizations, by addressing important aspects within the process, its principles, the steps followed within a structured methodology. In this thesis, first, the existing methodologies, best practices, standards, and tools in information risk assessment are compiled and evaluated according to well-defined criteria. Besides this evaluation, an integrated information risk assessment methodology is developed that uses the high potential of the previous methodologies and addresses their identified deficiencies. The new methodology is validated with a case study.