identified threats, and (3) determines mitigation strategies for those risks (including controls and other mitigation strategies). Personnel involved in the risk management The entity has defined a formal risk management do not have sufficient information to process that specifies risk tolerances and the risks and the tolerance of the entity for those process for evaluating risks based on identified risks. threats and the specified tolerances. One or more internal or external risks, that are During the risk assessment and management significant, threaten the achievement of [security, process, risk management office personnel availability, processing integrity, confidentiality, or changes to business objectives, commitments privacy] commitments and requirements that can and requirements, internal operations, and be addressed by security controls, are not factors that threaten the achievement of objectives and update the potential threats to system objectives. Identified risks are rated using a risk evaluation process and ratings are reviewed by The risk and controls group evaluates the of controls and mitigation strategies in meeting identified risks and recommends based on its evaluation. The risk and controls group's recommendations are reviewed and approved by senior The entity uses a configuration management and related process to capture key components, technical and installation
identified threats, and (3) determines mitigation strategies for those risks (including controls and other mitigation strategies). Personnel involved in the risk management do not have sufficient information to risks and the tolerance of the entity for those risks. The entity has defined a formal risk management process that specifies risk tolerances and the process for evaluating risks based on identified threats and the specified tolerances. One or more internal or external risks, that are significant, threaten the achievement of [security, availability, processing integrity, confidentiality, or privacy] commitments and requirements that can be addressed by security controls, are not During the risk assessment and management process, risk management office personnel changes to business objectives, commitments and requirements, internal operations, and factors that threaten the achievement of objectives and update the potential threats to system objectives. Identified risks are rated using a risk evaluation process and ratings are reviewed by The risk and controls group evaluates the of controls and mitigation strategies in meeting identified risks and recommends based on its evaluation. The risk and controls group's recommendations are reviewed and approved by senior The entity uses a configuration management and related process to capture key components, technical and installation
FINAL-ED-Trust-Services-Principles.docx