threat

The causes of the original threat. For example, web publishers may not be aware of
steps they could take; producers may be using standards incorrectly; or producers may
be at risk of business failure. This analysis might lead to action that addresses the
causes, such as education campaigns, the development of standards in conjunction
with producers, or development of indicators of impending business failure including
signs that web sits are not being maintained or personal knowledge that projects are
coming to a close.

Steps Worked example

1. Asset identification: identify what needs to be
protected, as specifically as possible
2. Threat identification: identify the threats that
appear to pose a risk to the programmes
objectives
3. Probability assessment: estimate the likelihood
of each threat happening
4. Consequence assessment: estimate the likely
impact if the threat did eventuate
5. Risk level assessment: Calculate the level of
risk by combining the probability and
consequence
6. Mitigation: propose action that could reduce the
likelihood or the impact of the threat, or both
7. Risk threshold: decide whether the level of risk
is acceptable with or without mitigation action
8. Allocation of ownership: determine who is
responsible for taking action, and any constraints
9. Priority setting: compare risk levels for
identified threats and decide what ris ks should be
given priority
10. Reality checking: decide whether the risk and
priority assessments tally reasonably well with
expectations
11. Action triggers: decide whether action is
needed immediately; if not, identify some signs
that will indicate when action is required
Online publication stored on a web site managed
by someone else
Access to a particular version of the online
publication will be lost because the owner
overwrites old versions with new versions
Very likely to happen, based on previous history
of the site
Likely to result in complete loss of the old
version, as the owner does not appear to maintain
an archive of overwritten versions
High risk likely to happen and would result in
complete loss
Options contact site owner and suggest owner
makes archived copies; negotiate permission to
take copies now; or to take copies before versions
are overwritten
Material is considered important so level of risk
warrants taking mitigation measures
The owner could be responsible but might not be
willing to take action; programme could take
responsibility but may need permission
High priority compared with other risks
No lingering doubts - the analysis makes sense
Owner approves copying by the preservation
programme immediately before each version is
overwritten, but cannot guarantee a schedule. The
programme decides to contact the owner regularly
for information on planned updates, and will
assess whether this proves to be an adequate
indicator.

Table 10-1 A simple risk management model

53