executive level position ○ Other: ___ ○ 1.02.03 Who in the agency is primarily responsible for setting security policy? Information Security Officer ○ Information Resources Manager ○ Executive Director (or equivalent) ○ Technology Division Director ○ No one ○ Other: ___ ○ 1.02.04 Who in the agency is primarily responsible for acceptance or mitigation decisions regarding agency security risks? Information Security Officer ○ Information Resources Manager ○ Executive Director (or equivalent) ○ Technology Division Director ○ No one ○ Other: ___ ○ 1.02.05 How does the Executive Director (or equivalent) sign off on high security risks? Always ○ Sometimes ○ Occasionally ○ Rarely ○ Never ○ 1.02.06 Who in the agency is primarily responsible for determining budget requirements to address security risks? Information Security Officer ○ Information Resources Manager or CIO ○ Executive Director (or equivalent) ○ Chief Financial Officer/Budget Director ○ No one ○ Other: ___ ○ 1.02.07 Who in the agency is primarily responsible for enforcing and ensuring compliance with security policy? Information Security Officer ○ Information Resources Manager ○ Executive Director (or equivalent) ○ Technology Division Director ○ Internal Audit ○ No one ○ Other: ___ ○ 1.02.08 How many dedicated (100% of time or full-time) security professionals does the agency employ, including agency staff and contractors? Enter a number. <number>
○ executive level position ○ Other: ___ 1.02.03 Who in the agency is primarily responsible for setting security policy? ○ Information Security Officer ○ Information Resources Manager ○ Executive Director (or equivalent) ○ Technology Division Director ○ No one ○ Other: ___ 1.02.04 Who in the agency is primarily responsible for acceptance or mitigation decisions regarding agency security risks? ○ Information Security Officer ○ Information Resources Manager ○ Executive Director (or equivalent) ○ Technology Division Director ○ No one ○ Other: ___ 1.02.05 How does the Executive Director (or equivalent) sign off on high security risks? ○ Always ○ Sometimes ○ Occasionally ○ Rarely ○ Never 1.02.06 Who in the agency is primarily responsible for determining budget requirements to address security risks? ○ Information Security Officer ○ Information Resources Manager or CIO ○ Executive Director (or equivalent) ○ Chief Financial Officer/Budget Director ○ No one ○ Other: ___ 1.02.07 Who in the agency is primarily responsible for enforcing and ensuring compliance with security policy? ○ Information Security Officer ○ Information Resources Manager ○ Executive Director (or equivalent) ○ Technology Division Director ○ Internal Audit ○ No one ○ Other: ___ 1.02.08 How many dedicated (100% of time or full-time) security professionals does the agency employ, including agency staff and contractors? Enter a number. <number>
2018%20IRDR%20Instructions.docx