In order to improve the quality of our quotations and provide exact pricing to our customers we like to collect a brief inventory of your information assets. Based on an understanding of your organization’s assets we can achieve much more precision in our pricing.
Why does Clearwater request an information asset inventory in order to provide a price for Risk Analysis Services?
Following the HHS/OCR Final Guidance on Risk Analysis and NIST SP800-30 Revision 1 Guide for Conducting Risk Assessments we perform Risk Analysis at the level of information assets that create, receive, maintain or transmit ePHI.
In our experience with these types of engagements there can be a wide variation in the number of information assets from one organization to the next. We have seen one organization with as few as 5 assets and some have hundreds. We don’t want to pad our estimates for uncertainty and hit our customers with high prices. Nor do we want to underestimate the effort and be rushed. To get you the highest quality work for the fairest price we like to collect an Information Asset Inventory.
We don’t charge for this initial inventory and we will provide all the support you need in compiling it. If you complete this inventory you will also have accomplished an initial step in a bona fide Risk Analysis! For additional information on the definition of an Information Asset go to What is an Information Asset?
Watch this video to learn more.