Case Study Of The Sprout Foundation

Executive Summary

The Sprout Foundation (TSF) in these years become a large tier 2 charity organisation. The mission of this company is to help third-world communities sustainably improve their lives, by education, clean water and health facilities. Although the organisation grown significantly, with a AUD 117 Million fund turnover per annum, the management, technical and operational areas of TSF IT Systems and policies are unresourced and are not well maintained.

It (TSF) has not conducted in the past a Risk Assessment, the identification of threats and vulnerabilities and prioritisation of risks is nonexistent.

TSF Head Office is located in Australia. It has many local and global partners, in this case it will be many different local law and international laws that need to be followed but may come into conflict, especially privacy law

An issue for TSF, a privacy concern as they hold some data in the US ( by any of US Based partners of TSF), due to the US law (Patriot Act), they have right to access any data on any computer system, within US borders, in certain but broad situations.

(WILL add more at the end)

(Cover Sheet will be added later by pdf joins)

Record of Changes/Version History

Change/Version Number

Date of Change

Sections Changed

Description

Person Entering Change

Draft-V1

15/04/2014

N/A

First Draft

N/A

Final Version (current document)

17/04/2014

No. 6

Calculation corrections

Anthony Gagliano

1. Introduction

Risk assessment report conduct by Anthony Gagliano and Joshua Chu, in April 2014, with future Risk Assessments recommended every budget cycle of The Sprout Foundation (TSF).

Purpose

TSF is a large tier 2 charity organisation. The mission of this company is to help third-world communities sustaina...

... middle of paper ...

...

7. Conclusion

Final Prioritised list of Risks

Further Risk Assessment Opportunities

(Total the number of observations. Summarise the observations (risk and prioritise them in a list due to the final figures )

References

National Institute of Standards and Technology (NIST): Risk Management Guide for Information Technology Systems. Special Publication 800-30, 2002.

Table 3-4. Likelihood Definitions, National Institute of Standards and Technology (NIST): Risk Management Guide for Information Technology Systems. Special Publication 800-30, 2002.

Table 3-5. Magnitude of Impact Definitions, National Institute of Standards and Technology (NIST): Risk Management Guide for Information Technology Systems. Special Publication 800-30, 2002.

Appendix A

Threat List (maybe or keep in body of report)

Vulnerability List

Appendix B

Acronyms

Glossary