within the Agency’s systems? Has the Agency appointed a senior-level executive (e.g., Appointment of an Information Security Risk Officer information security risk officer or equivalent) to decide on the assignment of risk remediation measures to designated Agency individuals? (e.g., Assigning risks related to patch management to the network and applications team heads respectively) Has your Agency established a process to continuously Establish a process to Monitor Information Systems on an monitor information systems to ensure controls are on-going basis operating as intended? (e.g., Auto-generating access logs for systems holding critical data and having a designated individual review these logs to check for irregularities, such as, failed login attempts) Has the Agency established a process to convert Establish a Risk Mitigation Process identified risks into acceptable remediation goals? (e.g., If access de-provisioning has been identified as a risk, where access of an individual leaving the Agency is not immediately revoked, the Agency must convert this risk into a remedial procedure wherein the required goal would be achieved) Has the Agency identified and documented a risk Establish a Risk Acceptance Process acceptance level for various identified threats based on business requirements? Has the Agency established a process to identify the impact of a potential risk?
within the Agency’s systems? Appointment of an Information Security Risk Officer Has the Agency appointed a senior-level executive (e.g., information security risk officer or equivalent) to decide on the assignment of risk remediation measures to designated Agency individuals? (e.g., Assigning risks related to patch management to the network and applications team heads respectively) Establish a process to Monitor Information Systems on an on-going basis Has your Agency established a process to continuously monitor information systems to ensure controls are operating as intended? (e.g., Auto-generating access logs for systems holding critical data and having a designated individual review these logs to check for irregularities, such as, failed login attempts) Establish a Risk Mitigation Process Has the Agency established a process to convert identified risks into acceptable remediation goals? (e.g., If access de-provisioning has been identified as a risk, where access of an individual leaving the Agency is not immediately revoked, the Agency must convert this risk into a remedial procedure wherein the required goal would be achieved) Establish a Risk Acceptance Process Has the Agency identified and documented a risk acceptance level for various identified threats based on business requirements? Has the Agency established a process to identify the impact of a potential risk?
Gap%20Analysis%20-%20Risk%20Management%20Policy%20-%20Final.docx