Abstract: Methods and apparatus, including computer program products, for risk assessment and analysis. Asset data representing a set of assets is received. Threat data representing a set of threats is received. Measures data representing a set of measures is received. A loss expectancy based upon the value of the assets, the potential reduction of value caused by the threats, and the protection of the value caused by the measures is automatically calculated. Project data representing a simulated project is received. A revised loss expectancy is automatically calculated based upon the value of the assets, the potential reduction of value caused by the threats, and the protection of the value caused by the measures as modified by the simulated project. A savings caused by the simulated project is automatically calculated based upon the loss expectancy and revised loss expectancy.

Abstract: Methods and apparatus, including computer program products, for risk assessment and analysis. In one general aspect, asset data representing a set of assets is received. Threat data representing a set of threats is received. Requirements data representing one or more requirements is received, wherein each requirement requires compliance with a regulation and a failure to satisfy the requirement constitutes a threat additional to the set of threats. Measures data representing a set of measures is received. A current status is calculated using the measures data and the requirements data based on a level of compliance with the requirements, the level of compliance determined by the measures and the additional one or more threats to one or more assets represented by the measures data and the requirements data.