PM-28 Risk Framing. Identify and document: Assumptions affecting risk assessments, risk responses, and risk monitoring; Constraints affecting risk assessments, risk responses, and risk monitoring; Priorities and trade-offs considered by the organization for managing risk; and
Risk Framing. Identify and document: Assumptions affecting risk assessments, risk responses, and risk monitoring; Constraints affecting risk assessments, risk responses, and risk monitoring; Priorities and trade-offs con.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Documented assumptions affecting risk assessments, responses and monitoring · SIEM / log platform
- Documented constraints affecting risk assessments, responses and monitoring · SIEM / log platform
- Evidence the risk framing was distributed to those who conduct assessments and make risk decisions · Document repository
- Review and update records for the risk framing against the defined frequency · Document repository
governing documentDocuments that govern the control
- The organisational priorities and trade-offs recorded for managing risk · Document repository
First move
Common gaps auditors find
- Assumptions held informally by the risk team and never written down, so assessments are inconsistent between assessors
- Trade-offs unstated, leaving risk acceptance decisions without a reference point
- Framing produced once and never revisited after the threat or business environment shifted
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-27 Privacy Reporting. Develop [organization-defined] and disseminate to: [organization-defined] to demonstrate accountability with statutory, regulatory, and policy privacy mandates; and [organization-defined] and other personnel with responsibility for monitoring privacy program compliance; and Review and update · PM-29 Risk Management Program Leadership Roles. Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and Establish a Risk Executive