“A different language is a different vision of life.” – Frederico Fellini

The heart of ITIL is the CMDB, where we centrally inventory all of the things that we care about.   ITIL and the CMDB allow a variety of groups to plan and work with common information and a common vernacular.   Why doesn’t the risk community extend the CMDB to measure risk?   Is it not equally desirable to have a central store of risk information that provides unified risk assessments and unified risk language?   There is tremendous leverage to be gained if our information security staff, compliance staff, business continuity staff, auditors, risk managers, privacy officers, legal staff, and others could agree on a single set of criteria for measuring the inherent risk associated with our systems.   Without a CMDB of risk, we:

• Create the possibility that all of these groups assess risk independently and differently.
• Allow duplicate and possibly inconsistent risk assessments within the same organization.
• May miss critical dependencies.   For example, if I have a mission critical activity subject to the highest levels of regulatory scrutiny, then all data feeds through this system may need to be elevated to the same level of importance.

If your organization’s CMDB reflects business processes, then it should be simple to extend the CMDB’s schema to include such information as: inherent risk ratings, regulatory impacts, and the data of the last risk assessment.   Even if this requires some rework to accomplish, it strikes me that the payback would more than justify the risk through simplified, consistent, and repeatable risk management.