PM-9 Risk Management Strategy. Develops a comprehensive strategy to manage: Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and Privacy risk
Risk Management Strategy. Develops a comprehensive strategy to manage: Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of orga.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- The stated risk tolerance and the acceptable risk assessment methodologies, response strategies and monitoring processes · SIEM / log platform
- Evidence of implementation consistently across the organisation, not only in one programme · Document repository
- Review and update records against the defined frequency · Document repository
- Evidence the strategy informs actual risk decisions, such as risk acceptances referencing the stated tolerance · Document repository
governing documentDocuments that govern the control
- The comprehensive risk management strategy covering both security risk and privacy risk · Policy repository / GRC workspace
First move
Common gaps auditors find
- Risk tolerance stated qualitatively in terms nobody can apply to a specific decision
- Privacy risk folded into security risk, losing the distinct harms to individuals the control separates
- Strategy exists centrally while business units run their own methodologies, defeating consistency
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-8 Critical Infrastructure Plan. Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan · PM-10 Authorization Process. Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes; Designate individuals to fulfill specific roles and responsibilities within the organizational risk