Risk Analysis Software

[Brad Miller <bradmiller () MAIL UND NODAK EDU>]

Has anyone used or evaluated any software packages for Risk
Management/Assessment?  I would like to conduct a fact-based risk
analysis on critical campus IT resources/processes based on NIST/ISO
standards, and would like to use a certain level of automation to cut
down on the time commitment.  I have looked at a few packages including
CounterMeasures (www.countermeasures.com), Riskwatch
(www.riskwatch.com), and  RSAM (www.relsec.com).  If anyone has any
experience with these or others, your comments would be greatly
appreciated.  Feel free to contact me offline if you'd like.

Thanks,
~Brad


Brad Miller
IT Security Officer
Information Technology Systems and Services
University of North Dakota
(701) 777-3587
http://itsecurity.und.edu