CRAMM


CRAMM is a risk management methodology, currently on its fifth version, CRAMM Version 5.0.

History

CRAMM was created in 1987 by the Central Computer and Telecommunications Agency, now renamed into Cabinet Office, of the United Kingdom government.

Methodology

CRAMM comprises three stages, each supported by objective questionnaires and guidelines. The first two stages identify and analyze the risks to the system. The third stage recommends how these risks should be managed.
The three stages of CRAMM are as follows:

Stage 1

The establishment of the objectives for security by:
The assessment of the risks to the proposed system and the requirements for security by:
Identification and selection of countermeasures that are commensurate with the measures of risks calculated in Stage 2.
CRAMM contains a very large countermeasure library consisting of over 3,000 detailed countermeasures organised into over seventy logical groupings.

Deployment

CRAMM is in use by NATO, the Dutch armed forces, and corporations working actively on security, like Unisys.
CRAMM is offered in English and Dutch versions.