5.4.1 Actions to address risks and opportunities
The actions to address risks and opportunities gain PIMS refinements: the risk assessment must identify privacy risks arising from processing as well as confidentiality, integrity and availability risks, must assess cons
4
artefacts
1
held by a system
2
at each review
moderate
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Risk records showing consequences assessed for the individual as well as for the organization · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Documented risk assessment process addressing security risk and privacy risk and the relationship between them · Data governance / DLP tooling
- Evidence the treatment comparison actually tested for omitted controls · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Statement of Applicability covering the PIMS annex applicable to the determined role, with justification for each inclusion and exclusion · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Policy repository / GRC workspace); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Consequence assessed as organizational impact only, with the individual absent from the scoring
- Statement of Applicability covering the ISMS annex alone, so PIMS controls are neither included nor excluded, merely missing
- Exclusions asserted without justification, or justified by a risk assessment that never considered the control
- Security and privacy risk assessed in isolation, so the relationship between them is managed by nobody
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.3.3 Organizational roles, responsibilities and authorities · 5.4.2 Information security objectives and planning to achieve them