SBIR Phase I: Information Risk Management System for Small and Medium-Sized Financial Institutions

This Small Business Innovative Research (SBIR) Phase I project will develop a tool to assist small and medium-sized financial institutions (SMFI) to understand their information risk and what they should do about it. This project will test the feasibility of pre-defining information security threats and countermeasures for each asset in a SMFI. The phase I goal is to accomplish this goal and address the technical challenges include: 1) Experiment with the feasibility of using two national standards to pre-define cyber risks, 2) Develop a pilot software product that leverages these national standards and 3) Determine the commercial viability of this software product. The proposal's broad impact is the pervasive positive impact on information protection in financial services. The security posture of SMFIs is concerning; however, with an intelligent tool which answers many of the risk management questions, all types of SMFIs can get an accurate read on where their risks are and what they need to do about it. If successful, this tool could address a significant underserved market in the financial services industry.