Most information risk management programs are cumbersome and expensive, requiring expertise and time that smaller organizations may not have. In addition, many attempts to start an information risk management program fail when the program seems to have no relevance to the organization except during audits. This workshop will cover a risk management program that is lightweight, useful, and can scale as the organization matures. This process has been successfully implemented and requires no specialized tools. By the end of the workshop, you will be able to perform a simple risk assessment and set up a useful and auditable risk management program.