RA-7 Risk Response
Requires the organisation to respond to findings from security and privacy assessments, monitoring and audits, so that identified risk is treated rather than only recorded.
system holds itEvidence a system already holds
- Records showing accepted risks are approved at the right level · Document repository
periodic reviewEvidence produced at each review
- Evidence findings from assessments and continuous monitoring feed the response process · SIEM / log platform
governing documentDocuments that govern the control
- Risk response plan or POA&M showing decisions per finding · Policy repository / GRC workspace
First move
Common gaps auditors find
- findings logged but never dispositioned
- risk acceptance without documented authority
- no link between monitoring output and response decisions
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetRA-5(11) Vulnerability Monitoring and Scanning | Public Disclosure Program. Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components · RA-9 Criticality Analysis. Identify critical system components and functions by performing a criticality analysis for [Assignment: organization-defined systems, system components, or system services] at [Assignment: organization-defined decision points in the system development life cycle]