RA-7 Risk response
Requires findings raised by assessments, monitoring activity and audits, covering both security and privacy, to be responded to in line with the organization's stated risk tolerance, so each is remediated, mitigated, tra
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Formal risk acceptance records where a finding is not remediated · Policy repository / GRC workspace
- Evidence responses are completed and verified · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Documented risk tolerance used to judge findings · Policy repository / GRC workspace
- Finding register showing the response decision and owner for each item · Policy repository / GRC workspace
First move
Common gaps auditors find
- Findings tracked but neither remediated nor formally accepted, leaving them open indefinitely
- Risk tolerance never expressed in terms that can decide a specific finding
- Acceptance made by someone without the authority to accept that level of risk
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetRA-6 Technical Surveillance Countermeasures Survey. Employ a technical surveillance countermeasures survey at [organization-defined] [organization-defined] · RA-8 Privacy Impact Assessments. Conduct privacy impact assessments for systems, programs, or other activities before: Developing or procuring information technology that processes personally identifiable information; and Initiating a new collection of personally identifiable information that: