Unit $02$ Data Classification Standards and Risk Assessment Methodology Assignment

Scenario

Fullsoft wants to strengthen its security posture. The chief security officer $($CSO$)$ has asked you for information on how to set up a data classification standard that's appropriate for Fullsoft.

In addition, the CSO wants to have a full risk assessment conducted and has asked you to provide recommendations for which risk assessment methodology to use. Two popular risk assessment methodologies are NIST SP $800-30$ revision $1,$ Guide for Conducting Risk Assessments, and Operationally Critical Threat, Asset, and Vulnerability Evaluation $($OCTAVE$).$ Your focus will be on the OCTAVE Allegro version, which is a more concise version of OCTAVE. When reviewing the methodologies, consider the following: Which features or factors of each methodology are most important and relevant to Fullsoft? Which methodology is easier to follow?

Which methodology appears to require fewer resources, such as time and staff, but still provides for a thorough assessment? Tasks

For this part of the project:

Research data classification standards that apply to a company like Fullsoft. Determine which levels or labels should be used and the types of data they would apply to$.$

Create a PowerPoint presentation on your data classification scheme to be presented to the CSO

Review the following two risk assessment methodologies:

NIST SP $800-30,$ Guide for Conducting Risk Assessments

Operationally Critical Threat, Asset, and Vulnerability Evaluation $($OCTAVE$),$ Allegro version

Create a report that describes each risk assessment methodology, a recommendation for which methodology Fullsoft should

mes.

$[$:

citv

A