Version classiqueVersion mobile

Da produção à preservação informacional: desafios e oportunidades

Nelson Vaquinhas
Marisa Caixas
Helena Vinagre

Parte III - Preservação digital

How can Risk Assessment techniques be used to estimate Costs for Digital Curation?

Raquel Bairrão, Nuno Pradiante, Ricardo Vieira et José Borbinha


Digital Curation involves maintaining, preserving and adding value to digital assets throughout its lifecycle. As a long term activity, estimating priorities and costs is therefore a key challenge. When considering digital preservation as part of Digital Curation concerns, we realized that the body of knowledge of Risk Management can be helpful to estimate part of the costs that are related to the controls the organization has to put in place to mitigate the perceived preservation risks.
Therefore, we propose that risk management for digital repositories can be a new expertize that archivists can consider addressing in order to reinforce their relevance in Digital Curation.

Texte intégral


1Archivists, when involved in the governance of digital repositories, should be able to contribute to the assessment of the value of each data object, understanding what is worthy protecting, why and how. The process of preserving digital objects will require institutions to make decisions involving a certain amount of risk, which cannot be avoided, but must be as much as possible conscientious. That can be possible to be achieved by giving attention to the identification of the threats and uncertainties associated to each decision, and deciding what controls to apply to prevent or minimize negative impacts. To do that with proved methods and techniques is the purpose of Risk Management (RM)!

  • 1 ISO/FDIS 31000:2009(E) - Risk Management: Principles and guidelines
  • 2 IEC/FDIS 31010:2009(E) - Risk management: Risk assessment techniques

2A risk can be defined as the likelihood of an event to occur along with its consequences for a specific business, which can be negative but also positive. The measures taken to prevent that are defined as controls. A rigorous investigation of risks and applicable controls for Digital Curation will be expected to give a reference of the suitable digital preservation activities, their expected benefits and estimated costs. This information can be used by curators when engaging in communication with stakeholders in order to have a common base language to negotiate possible refunding or future investments regarding digital preservation. Therefore, we aim to propose here some guidelines on how to assess scenarios for the identification of digital preservation risks and possible options for controls, which costs, once estimated, can provide valuable source of information for a more rigorous process of decision taking. The principles and guidelines we are here using are based on ISO/FDIS 31000 - Risk management principles and guidelines1, as well as assessment techniques inspired by the ISO/IEC 31010 - Risk assessment techniques2. This article therefore proposes guidelines, supported by stablished RM concepts, that can be applied to help a data repository gain awareness of their costs.

Risk Management

  • 3 ISO/TR 31004:2013(E) - Risk management: Guidance for the implementation of ISO 31000

Risk is the effect of uncertainty on objectives, regardless of the domain or circumstances, therefore an event or a hazard (or any other risk source) should not be described as a risk. Risk should be described as the combination of the likelihood of an event (or hazard or source of risk) and its consequence.3

3Assuming that an important part of the concerns of a digital curation stakeholder is to deal with uncertainty, the hypothesis that the established body of knowledge on RM can be valuable for the domain of curation sounds reasonable. RM involves defining a process comprising the actions of establishing an appropriate infrastructure and culture by applying a systematic method of establishing the context, identifying, analysing, evaluating, treating, monitoring and communicating risks associated with any activity, function or process in a way that will enable organizations to minimize losses and maximize gains (see Figure 1). The main references on RM from the International Standards Organization (ISO) are:

  • ISO 31000: Risk management principles and guidelines;

  • IEC 31010: Risk assessment techniques;

    • 4 ISO GUIDE 73:2009(E/F) - Risk management: Vocabulary

    ISO Guide 73: Vocabulary for risk management4;

  • ISO 31004: Risk management - Guidance for the implementation of ISO 31000.

4According to these standards, for each specific context a RM process must be defined, as described in the ISO/FDIS 31000 (and sketch in in the Figure 1), which for the assessment steps can use of techniques listed in the ISO/FDIS 31010. We can stress, from the core concepts of this domain, the following main relevant concepts for our present discussion (these concepts are complemented by the process described in the Figure 2):

  • Risk – an objective exposed to uncertainty;

  • Uncertainty - lack of sufficient relevant knowledge for a particular objective;

  • Vulnerability – an uncertainty that could have a negative effect for a particular objective;

  • Threat – the exploitation of a vulnerability;

  • Loss – a negative effect on an objective from a threat;

  • Opportunity - an uncertainty that could have a positive effect for a particular objective;

  • Gain – a positive effect on an objective from the exploitation of an opportunity;

  • Risk Management - The systematic process of identifying and analyzing risks and responding by defining controls;

  • Control – measures that is modifying a risk.

Fig. 1 - Risk Management Process [ISO/FDIS 31000]

Fig. 1 - Risk Management Process [ISO/FDIS 31000]

Fig. 2 - Conceptual map relating the most relevant concepts in Risk Management

Fig. 2 - Conceptual map relating the most relevant concepts in Risk Management

5Accordingly, organizations finding RM relevant for their governance should define an internal RM process taking as reference the generic method proposed in the ISO 31000. For doing that, the catalogue of techniques listed in IEC 31010 is a very convenient reference.

6From the ISO/TR 31004:2013 we also can learn that:

Organizations of all kinds face internal and external factors and influences that make it uncertain whether, when and the extent to which, they will achieve or exceed their objectives. The effect that this uncertainty has on the organization’s objectives is risk. (…) The understanding that risk can have positive or negative consequences is a central and vital concept to be understood by management. Risk can expose the organization to either an opportunity, a threat or both. (…) Controls are measures implemented by organizations to modify risk that enable the achievement of objectives. Controls can modify risk by changing any source of uncertainty (e.g. by making it more or less likely that something will occur) or by changing the range of possible consequences and where they may occur.

7From these references we can conclude that, even if we are not following a specific RM process as part of the governance framework of a repository, we cannot avoid to have to deal with the identification of risks and controls. However, as a complete RM method can be complex and expensive to implement, we are here proposing simplified guidelines that can be used for a preliminary phase of costs estimation.

Risk Management and Digital Curation

Digital curation involves maintaining, preserving and adding value to digital research data throughout its lifecycle. The active management of research data reduces threats to their long-term research value and mitigates the risk of digital obsolescence. (…)5.

8In simple terms, we can claim that the main objective of a repository is the curation of assets, which in their primary form are usually data sets, but also can be services directly related to those data sets, in secondary or derived forms.

9According to the concepts of the previous section, one can argue that costs are what we have to give up for controls, which are the measures that we have to put in practice to minimize loss (digital preservation) or also to maximize gain (digital curation in a broad sense). In that sense, a control is anything we are considering to apply either to minimize negative impacts or to take advantage of opportunities to produce value and thus bring gains. However, we also must agree that, in most of the usual digital curation scenarios, it is usually very complex to estimate the absolute value of an asset. Therefore, helping the management of a repository to gain conscience of the controls it already applies or must apply due to risks can be a valuable contribution to help to model the costs of that business.

10Table 1 presents examples of some of the Risks and Controls identified for the context of Digital Curation.

Table 1 - Example of Risks per category and applied Controls

Table 1 - Example of Risks per category and applied Controls

A Pragmatic Method to Estimate Costs

11Performing a proper RM process, as proposed by ISO31000, would be always the desirable scenario. But that can be expensive, only affordable to large organizations with fair resources. However, we propose that ISO31000 can be, anyway, an important source of inspiration for a pragmatic method aiming not in an overall RM, but only to estimate costs. That method is as follows:

  1. Identify the fundamental cost determinants for the case under analysis (this must be done with the major stakeholders of the repository, or using references as explained in the next section).

  2. Execute a Pragmatic Risk Assessment: Use a risk repository, or consult risk experts (such as a specialized archivist), in order to identify relevant risks associated to the identified determinants;

  3. Understand Actual Risk Treatment:

    1. Consolidate the risks identified (mainly, to detect repetitions and overlaps)

    2. Use your internal information, eventually also consulting a risk repository or experts, in order to identify the controls that you actually are applying for the consolidated risks

  4. Estimate the Costs: Acquire conscience of the costs for these controls (the ideal is to calculate these costs precisely, but ultimately the best estimation also can provide to be useful)

A Pragmatic Method to Estimate Costs

12The 4C project6 developed an “initial list of indirect economic determinants was compiled through consultation with experts from the project consortium and has in the course of work been expanded through discussions with stakeholder groups and the project advisory board.”

13Table 2 shows the determinants that resulted of these activities (numbers after the determinants names mean how that determinant was ranked by the consulted stakeholders), as also their perceived relation to the concepts of RM, resulting from the analysis of these sources:

  • Deliverable D4.17 of the 4C Project (“A prioritised assessment of the indirect economic determinants of digital curation”) 8

    • 9 Digital Curation Centre and Digital Preservation Europe, (February 2007). DCC and DPE Digital Repos (...)

    DRAMBORA - Digital Repository Audit Method Based on Risk Assessment9

Table 2 - A generic risk identification and analysis of the indirect economic determinants


Related risks

(possible consequence in case of hazard)

Generic controls

(source of costs)


Loss of reputation and trust

Preservation plan


Ability to deliver

Business plan


Exposure to competitors

Security auditing

Security certification


Exposure to financial uncertainty

Performance assessment

Re-engineering / Change management





Inability to explore new opportunities

Re-engineering / Change management


Loss of reputation and trust

Marketing plan


Exposure to obsolesce

Uncertainty of early adopter

Inability to explore new opportunities

Research and development

Re-engineering / Change management


Ability to deliver



Quality of service

Quality auditing

Quality certification



Marketing plan


Risk Management

Risk management plan


Liability in sensitive data breaches

Loss of reputation and trust

Security auditing

Security certification


Loss of efficiency if key staff leave

Staff assessment

Staff training

Staff salaries/benefits


Exposure to financial uncertainty

Business plan

Marketing plan


Loss of reputation and trust

Marketing plan


Loss of reputation and trust

Trustiness auditing

Trustiness certification


Ability to deliver

Business plan

14This list only provides a generic view of the related risks and generic controls based on the indirect economic determinants from deliverable D4.110. However, as stated in the Annex I if the deliverable D3.211, these determinants are “context and stakeholder dependent”, so each organization must check for each of them if they are relevant and, in case of yes, also define the clear meaning of if in that context. Based on the resulting from that, the risk and controls must then be identified.

15Table 3 presents examples of specific controls for the generic controls listed in Table 2. These references were taken from the “D4.3— Quality and trustworthiness as economic determinants in digital curation”12, as also from the following sources (several domains were researched, such as IT Management and Governance, Quality Assessment, Digital Preservation and Information Management, etc.):

  • Fundamental sources:

    • Digital Repository Audit Method Based on Risk Assessment (DRAMBORA);

    • ISO31000 family of standards for risk management;

      • 13 ISO 9001:2008 - Quality management systems: Requirements.

      ISO9001 an international standard for quality manage net systems that details the requirements for such systems13,

      • 14 ISO/IEC 25010:2011 - Systems and software engineering: Systems and software Quality Requirements an (...)

      ISO25010 from systems and software engineering detailing the system quality models14;

    • Business Model Canvas (BMC)15;

      • 16 IT Governance Institute - COBIT 5: A business Framework for the Governance and Management of Enterp (...)

      Control Objectives for Information and Related Technology (COBIT) from the IT Governance Institute that is a framework for governance and management of IT in organizations16;

  • Sources of our main domain (digital curation and preservation), relevant for analysis or usage for controls for identified risks:

    • PLATO17 is a preservation planning tool;

      • 18 ISO 16363:2012 - Space data and information transfer systems: Audit and certification of trustworth (...)

      ISO16363, a standard for the audit and certification of trustworthy digital repositories18;

    • Data Seal of Approval19 (DSA), that offers an online tool that assess and certifies repositories on their data policies;

  • Other potentially relevant auxiliary references:

      • 20 ISO/IEC 27001:2013 - Information technology: Security techniques; Information security management s (...)

      ISO27001, that describes the requirements for information security systems20;

      • 21 BAKER, M. - The Strategic Marketing Plan Audit. Cambridge Strategy Publications. 2008

      Strategic Marketing Plan audit from M. Baker21, which describes the whole process of creating and assessing a marketing strategy.

16However, this list must not be accepted as final, as more references can be seen useful to identify controls.

Table 3 - Examples of relevant references for the generics controls

  • 22 IT Governance Institute - COBIT 5 – Enabling Processes. 2012

Generic controls

Examples of specific relevant references

Business plan

BMC – The business model canvas allows organizations to fill their business model in a canvas that allow for easy understanding of their business, which can then be used to create a business plan of the organization.


ISO9001 – The ISO9001 contains requirements for the infrastructure and work environment of organizations that want to achieve a higher level of quality. It contains requirements for buildings, workspace, utilities, equipment and supporting services.


ISO25010 – The ISO25010 is a standard for systems and software quality requirements and evaluation and depicts the quality model for systems and software. It takes into consideration maintainability as “degree of effectiveness and efficiency with which a product or system can be modified by the intended

Maintainers”. This standard allows for measurement of maintainability and can help understanding the current state of a system regarding maintenance.

Marketing plan

M. Baker: The strategic Marketing Plan Audit - Michael Baker provides in his book a way to plan an organizations marketing strategy. There are seven types of planning described in this book, and it guides the organization in choosing which it the most appropriate. Then, having in mind the organization’s marketing objectives, it allows to measure how well the marketing strategy is aligned with the objectives and whether or not these objectives are being met. The audit considers eights steps, (1) Mission Statement, (2) Marketing Appreciation, (3) Conclusions and key assumptions, (4) Strategic objectives, (5) Core strategy), (6) Key Policies, (7) Administration and Control and (8) Communication and timing.


COBIT22 – The DSS01 process provides guidelines and activities on how to coordinate and execute operations to deliver services. This process details how to perform operational procedures, manage outsource services, and manage facilities.

Performance assessment

COBIT – The APO07 process of COBIT can be used to assess the performance of the organization staff.

Preservation plan

PLATO - The preservation planning tool PLATO is a tool that implements a preservation planning process and services for “content characterisation, preservation action and automatic object comparison” that provides support for preservation planning.

Quality auditing

ISO9001 – The ISO9001 is the reference on quality certification. The goal of it is to assure that an organization’s products and services meet the quality standards of their clients and also aims at continuous enhancement of quality.

Quality certification

ISO9001 – The ISO9001 provides a certification against the standard, which is recognized amongst the world as a seal of quality for an organizations products and services.

Re-engineering / Change management

COBIT – The BAI05 process in COBIT delivers the activities needed by organizations to effectively manage organizational change enablement. This process maximises the likelihood of implementing organizational change quickly and with reduced risk. Also, BAI06 process enables organizations to manage change in a controlled manner; this includes standard changes in business processes, applications and infrastructure but also covers emergency maintenance.

Research and development

ISO9001 – Managing and implementing research and development can be difficult for organizations. Despite this the guidelines provided by the ISO9001 can be used to this domain, in order to improve the quality of research and development.

Risk management plan

ISO31000/31010 – The ISO31000 is a collection of standards for RM, where ISO31000 provides the principles and guidelines for RM and the ISO31010 provides the risk assessment techniques to be used in specific scenarios. These standards can be used to develop a RM plan for an organization.

DRAMBORA - The Digital Repository Audit Method Based on Risk Assessment toolkit characterizes digital curation as a risk-management activity, because it recognizes the job of a digital curator as the rationalization of the uncertainties and threats that inhibit efforts to maintain digital object authenticity and understandability, transforming these into manageable risks. There are six stages within the process. The first stages require that auditors develop an organizational profile, describing and documenting the repository's mandate, objectives, activities and assets. Then, risks are derived from each of these, and assessed in terms of their likelihood and potential impact. In the end, auditors are encouraged to conceive of appropriate RM responses to the identified risk.

Security auditing

ISO27001 – The ISO27001 is the reference on information security management. It provides a set of requirements, processes and controls so that an organization can mitigate and manage the risk regarding information management.

Security certification

ISO27001 – There is a certification for the ISO27001, which certifies that the organization has good information management processes and controls and meets all the requirements. This certification is recognized throughout the world.

Staff assessment

COBIT – COBIT processes delivers processes that can be used to assess the staff and check whether the staff is capable of dealing with arising issues. The APO07 process allows for evaluation of the staff performance, the maintenance of skills and competences, and maintaining adequate and appropriate staff to achieve the organization business goals.

Staff salaries

COBIT – The APO07 process aims at managing human resources in an organization. It provides the activities necessary to manage contract of the staff, including salaries.

Staff training

COBIT – The BAI08 process provides the guidelines to manage the knowledge existing in the organization. This process allows for internal training of staff, as well as, the identification of useful sources outside the organization. The APO07 process also delivers guidelines on how to maintain staff skills.

Trustiness auditing

ISO16363 – The ISO16363 provides all the guidelines in order to be a trustworthy repository. It also provides a checklist to become a trustworthy repository.

DSA – The Data Seal of Approval is a self-assessment tool that can be used to check the current state of a repository. It contains 16 guidelines that evaluate the repository. There is an on-line tool that repositories can use to submit their assessment that is then reviewed by peers and based on the answers and documentation provided the Data Seal of Approval can then be awarded to the organization.

Trustiness certification

ISO16363 – There is a certification for ISO16363 that repositories can also use to certify their organization and become recognized as a trustworthy repository.

DSA – After submitting the answers and documentation for obtaining the Data Seal of Approval the repository is awarded the Data Seal of Approval, which includes a DSA logo to be displayed on the organization’s website.

The Risk Expert Role and Responsibilities

17As we stated in the section 2, a formal risk assessment of a business, in order to identify in detail all the necessary controls, can be very complex, requiring the involvement of experts, eventually of multiple sectors the business depends on.

18A risk expert should be a person with knowledge of principles, processes and techniques to identify, analyse, evaluate and treat any risk. As a main responsibility, the risk expert should be consulted in all steps of the RM process. This is where we identify an opportunity for Archivists.

19The main capabilities that an Archivist, seen as a risk expert should have are:

  • Core:

    • Risk Management: know the process on how to identify, analyze, evaluate and treat risks;

    • Metadata: Know how to produce, collect and secure metadata;

    • Advocacy, copyright and intellectual property rights: to mitigate risks concerning data dissemination;

  • Complementary:

    • Technical skills: determine technology or infrastructure risks and controls;

    • Data value: assess the value of the data objects worth protecting.

Example of a Tool to Support the Management of Risk Repositories

20Organizations always have, internal and external, factors that can pose a risk to the achievement of their objectives. RM is the field responsible for defining and managing controls, and policies, to address those risks that affect valuable assets. RM can be useful in several different contexts. It can be applied in an entire organization, a specific department or area, or even a specific function, project or activity. This diversity of contexts also results in one of the main problems of a valuable integrated RM, as efforts operate in silos with narrowly focused, functionally driven, and disjointed RM activities. As consequence, organizations are faced with a fragmented view of risks, with different languages, parameterizations, and metrics that lead to highly complex specific-built solutions that cannot be reuse.

21HoliRisk is a flexible generic framework, originally developed by the INESC-ID in the TIMBUS project23, to support the steps of risk assessment, which was designed taking in consideration the principles from ISO31000.

HoliRisk Overview

22HoliRisk is a framework primarily designed to support a RM process considering the needs of the following business stakeholders:

  • Strategic Manager – Stakeholder with governance concerns, responsible to determine the strategic direction of the organisation and for creating the environment and the structures for RM to operate effectively;

  • Risk Expert – Stakeholder responsible to assist the organisation in establishing a RM process by providing RM expertise. Responsible for keep up to date with developments in the field;

  • Risk Manager – Stakeholder responsible for developing the RM policy and coordinate all RM activities across the enterprise, including the collaboration and consensus required to support enterprise RM (ERM) activities and decisions;

  • Risk Operator – Stakeholder responsible for understanding, accepting and implementing RM processes. Responsible for reporting inefficient controls, loss events and near miss incidents.

23Table 4 proposes a RACI matrix of these stakeholders in the different levels, according to the following definitions, cited from the ISO/FDIS 31000:

  • Responsible: The individual(s) who actually does the work to complete a task or action.

  • Accountable: The individual who is ultimately answerable for the correct completion of the task or for the decision outcome. Only one accountable can be assigned to an action. The accountable right bestows veto power and determines the specifics of the responsibility of the Responsible roles. Often the Accountable role will need to approve or signoff before the task can be declared completed.

  • Consulted: The individual(s), typically subject matter experts, who need to be consulted to complete the task or prior to final action or decision. This is typically a two-way communication.

  • Informed: The individual(s) to be informed upon the completion of the task/action or outcome of the decision. This is a one-way communication.

24HoliRisk is a framework intended to be used mainly by Risk Experts and Risk Operators in the support of their roles of responsibility. A relevant requirement is also the assumption that in many real life scenarios an effective integrated risk assessment must be carried out considering multiple expertizes, representing the multiple domains relevant for that RM (e.g.: legal; security; compliance; economic; etc.). Therefore, the requirement for the framework to be able to deal with multiple domains, implying:

  • For the role of Risk Expert, it also needs to be considered two roles:

    • The generic Risk Expert able to configure generic templates (metamodels) for models;

    • Specialized Domain Experts that can configure models, eventually reusing generic templates;

  • For the role of Risk Operator, the ability to define a context and to manage instances of models.

Table 4 - Risk Stakeholders and respective responsibility roles

Table 4 - Risk Stakeholders and respective responsibility roles

Domain Model Core Concepts

25The core concepts of the domain model in HoliRisk are:

  • Asset – an entity with value to be protected or valuated in the context of the RM;

  • Vulnerability – a flaw that can expose Assets to an Events;

  • Event – something that can happen with an estimated likelihood and triggers Consequence;

  • Consequence – and effect or impact on an Asset (can be positive or negative);

  • Risk – the hazard of chance or loss resulting from the combination of an Event and a Consequence;

  • Control – A mitigation, applied as part of a RM Policy, which typically can be:

    • Risk Acceptance

    • Likelihood Reduction

    • Impact Reduction

    • Exposure Reduction

    • Risk Transfer

  • Policy – A Policy is a set of Controls.

Risk Repository

26The HoliRisk Risk Repository use cases are presented in the Figure 3, which can be described as follows (Figure 4 shows a glimpse of the interface of the tool):

  • Actor: Risk Expert

    • Manage Concept – Creates concepts to be used in Model Templates;

    • Manage Attribute – Creates the attributes to be used in Model Templates (it can be done by reusing a concept already defined or, if necessary, a new concept for that purpose can first be created);

    • Manage Range – Define the range for each attribute (it can be done by reusing a concept already defined or, if necessary, a new concept for that purpose can first be created);

  • Actor: Domain Expert

    • Manage Model Template - Create/Edit/Remove a Model Template and associate to it the attributes created by the Risk Expert;

    • Manage Model - Create/Edit/Remove Models including the association of a Model Template to the Model. Also, when editing the Model, this user can manage Base Components (Create/Edit/Remove) to be used by default (Assets, Events, Vulnerabilities, Consequences, Controls or Policies). This user can also import and export each Model to or from Excel and XML formats.

Figure 3 - Main Use Cases of the HoliRisk Risk Register

Figure 3 - Main Use Cases of the HoliRisk Risk Register

Figure 4 - HoliRisk User Interface of the Risk Register

Figure 4 - HoliRisk User Interface of the Risk Register

Conclusion and Future work

27The value of RM for the planning and management of Digital Curation is advocated. A method for that was proposed (an achievement of the 4C project). We also illustrated how a method like that can be assisted by a suitable RM software tool, such as HoliRisk, a tool under development at the INESC-ID in the following of an initial proof of concept created in scope of the TIMBUS project. This tool is still under development, with its expected public release for generic use for the middle of 2016 (along with a repository of a set of risk registers for several domains of RM, including Digital Curation and Digital Preservation, with a special emphasis in scenarios of scientific data management and recordkeeping).

This work is partially supported by the European Commission under the 7th Framework Programme for research and technological development and demonstration activities, under the grant agreement 600471 (project 4C – Collaboration to Clarify the Costs of Curation), by the project TIMBUS (FP7/2007-2013) under grant agreement no. 269940, and also supported by national funds through FCT – Fundação para a Ciência e a Tecnologia, under project PEst-OE/EEI/LA0021/2013. In the developed of our research work we also want to acknowledge the participation of our colleagues Diogo Proença, who is working in the 4C team project to assess the costs of Digital Curation, and João Edmundo, the main developer of HoliRisk.


1 ISO/FDIS 31000:2009(E) - Risk Management: Principles and guidelines

2 IEC/FDIS 31010:2009(E) - Risk management: Risk assessment techniques

3 ISO/TR 31004:2013(E) - Risk management: Guidance for the implementation of ISO 31000

4 ISO GUIDE 73:2009(E/F) - Risk management: Vocabulary




8 All the detailed information about the determinants and other results of the 4C project is available from:

9 Digital Curation Centre and Digital Preservation Europe, (February 2007). DCC and DPE Digital Repository Audit Method Based on Risk Assessment, v1.0. Retrieved 22.03.2014, from ISO (2009)




13 ISO 9001:2008 - Quality management systems: Requirements.

14 ISO/IEC 25010:2011 - Systems and software engineering: Systems and software Quality Requirements and Evaluation (SQuaRE); System and software quality models.

15 OSTWERWALDER, Alexander - Business Model Generation. [Online] Available:

16 IT Governance Institute - COBIT 5: A business Framework for the Governance and Management of Enterprise IT. 2012


18 ISO 16363:2012 - Space data and information transfer systems: Audit and certification of trustworthy digital repositories.


20 ISO/IEC 27001:2013 - Information technology: Security techniques; Information security management systems; Requirements

21 BAKER, M. - The Strategic Marketing Plan Audit. Cambridge Strategy Publications. 2008

22 IT Governance Institute - COBIT 5 – Enabling Processes. 2012


Table des illustrations

Titre Fig. 1 - Risk Management Process [ISO/FDIS 31000]
Fichier image/png, 147k
Titre Fig. 2 - Conceptual map relating the most relevant concepts in Risk Management
Fichier image/png, 254k
Titre Table 1 - Example of Risks per category and applied Controls
Fichier image/png, 126k
Titre Table 4 - Risk Stakeholders and respective responsibility roles
Fichier image/png, 66k
Titre Figure 3 - Main Use Cases of the HoliRisk Risk Register
Fichier image/png, 26k
Titre Figure 4 - HoliRisk User Interface of the Risk Register
Fichier image/png, 172k






© Publicações do Cidehus, 2017

Conditions d’utilisation :

Rechercher dans OpenEdition Search

Vous allez être redirigé vers OpenEdition Search