What Is CRAMM?

by Simon Marvell

The following Risk Management Question of the Month is a bit different from previous Questions. In line with our goal of keeping you conversant on what's happening in the field of risk management, we'll periodically take a look at the software risk tools, frameworks, and techniques that are available to help organizations manage their various risks. (Please note that Cutter Consortium neither endorses nor promotes these tools. We bring this information to your attention with the sole purpose of keeping you well informed and up-to-date.) In this first installment of the series, we asked Simon Marvell about a tool called CRAMM, which grew out of a UK government IT security risk management initiative in the late 1980s and early 1990s, and now has a worldwide following.