Agile Methodology for Computer Risk Management

Abstract

This article presents a comprehensive methodology for IT risk management based on globally accepted standards such as ISO 31000 and ISO / IEC 27005, which states the requirements for an adequate risk management; however, they do not indicate, at least in a clear manner, the way in which such management can be carried out. Recommendations and good practices from other international risk management standards and guidelines are therefore included. Its validity is verified through the application of the proposed methodology in an industrial food company; Furthermore, the work team that applied the methodology had at its disposal the suggested tools that helped to technically assess the risks according to their occurrence probability, their consequences, and safety dimensions affected.