A framework for comparing different information security risk analysis methodologies

Organisations wanting to conduct information security risk analysis may find selecting a methodology problematic. Currently there are numerous risk analysis methodologies available, some of which are qualitative while others are more quantitative in nature. These methodologies have a common goal of estimating the overall risk value. An organisation must select the most appropriate methodology based on its specific needs. This article addresses the problem by presenting a framework that can be used to compare different risk analysis methodologies. Five methodologies, which are currently available, were analysed in order to establish the framework for comparison.