Stop guessing what your information systems are worth.
 
The SRMBOK Information and System Value Assessment gives you a complete, repeatable method for assessing the business impact and security value of your information and systems — without building an assessment from scratch every time.
 
The toolkit includes a ready-to-use workbook plus a fully worked, end-to-end example, so you can see not only what to enter, but how the judgments are actually made.
 
Assess each system across confidentiality, integrity, and availability, using eight consequence categories and calibrated Business Impact Levels. The workbook then records the resulting impact level, sensitivity label, caveats, and — critically — the reasoning behind the assessment.
That means you get consistent, defensible results across an entire system portfolio rather than a spreadsheet full of numbers nobody can explain six months later.
 
What’s included
 
The complete assessment workbook
Information and system ownership and service elements
Eight consequence categories with 0–5 impact criteria
Confidentiality, integrity, and availability assessment
Business Impact Level and sensitivity classification
ICT lifecycle, hosting, backup, disaster recovery, and access management
Built-in formulas, lookups, and rating logic
Glossary, FAQ, and PSPF/NIST/commercial classification crosswalks
 
The fully worked Riverina Water Corporation example
 
Five systems assessed end to end, including SCADA, customer information, laboratory, public-facing, and asset management systems.
 
More importantly, it shows the judgment behind the numbers: why the highest credible consequence governs rather than the average, why zero is a legitimate rating, how external controls affect system value, and why a highly valuable system does not necessarily contain secret information.
Use the worked example as a reference, a training aid for new analysts, or a starting point for your own assessments.
 
Built to be adapted
 
The consequence criteria, sensitivity labels, and information categories can be recalibrated to match your organization’s risk framework and policies.
Once configured, the same method can be applied consistently across your entire system portfolio.
 
One organization license. No subscription. No per-seat fee.
 
Download it once. Adapt it to your organization. Use it across your portfolio.
 
If you're still not sure, check the how-to video on the worked example below (also on YouTube) or download the free PDF guide & example.