HackingTheUniverse

This is where the need and purpose for the information system is defined and documented.  It is important to involve key stakeholders and/or business partners in this phase, whether they are internal or external to the group defining the system.

design the system

The requirements for the information system must be established, but at this point, some of them will be in general terms.  This includes:

• System Characterization
• Beginning to outline the Risk Assessment process

(both of these areas are covered more in depth in the sections linked above)

The ongoing process of collecting system knowledge begins here with:

• Inventory and Asset Management
• Site Security Plan
• Risk Assessment
• Configuration Management