The Risk Assessor / Information Asset Owner(s) should determine the alternate risk treatment option to be selected as per the Management’ process for the following types of risks: ‘Issues The RRs that cannot have feasible additional controls; and The RRs ratings that are not acceptable and have ceased to find additional controls Step 21 Consolidate Results in ISRR and Draft ISRM Report – Security Manager / Risk Assessor shall consolidate the information security risk management results from various business units in the final Information Security Risk Register; Security Manager develop the draft Information Security Risk Management report, which includes; Consolidated Information Security Risk Register List of risks modified, shared, avoided and retained; and Top 10 risks pertaining to the State Agency / Organization Output Draft Security Risk Management’ report and consolidated ISRR with the list of ‘Information information security risks to be modified, avoided, shared and retained. It includes: Risk modification & sharing plan and residual risks subject to the acceptance decision of the Information Security Steering / Governance Committee or management; and A list of avoided / retained risks with justification for those that do not meet the organization’s normal risk acceptance criteria Roles and Responsibilities Process Risk Subject Security Information IT Manager Information Step ref Assessor Matter Manager Security Steering / Asset/ Service Expert Governance Owner (SME) Committee 14 R C S I R A 15a C S I C A 15b C S I A 15c C S I A 15d C S I A 15e S R,A 15f S S R, A
The Risk Assessor / Information Asset Owner(s) should determine the alternate risk treatment option to be selected as per the ‘Issues Management’ process for the following types of risks: The RRs that cannot have feasible additional controls; and The RRs ratings that are not acceptable and have ceased to find additional controls Step 21 – Consolidate Results in ISRR and Draft ISRM Report Security Manager / Risk Assessor shall consolidate the information security risk management results from various business units in the final Information Security Risk Register; Security Manager develop the draft Information Security Risk Management report, which includes; Consolidated Information Security Risk Register List of risks modified, shared, avoided and retained; and Top 10 risks pertaining to the State Agency / Organization Output Draft ‘Information Security Risk Management’ report and consolidated ISRR with the list of information security risks to be modified, avoided, shared and retained. It includes: Risk modification & sharing plan and residual risks subject to the acceptance decision of the Information Security Steering / Governance Committee or management; and A list of avoided / retained risks with justification for those that do not meet the organization’s normal risk acceptance criteria Roles and Responsibilities Process Step ref Risk Assessor Subject Matter Expert (SME) Security Manager Information Security Steering / Governance Committee IT Manager Information Asset/ Service Owner 14 R C S I R A 15a C S I C A 15b C S I A 15c C S I A 15d C S I A 15e S R,A 15f S S R, A
cs-information_security_risk_management_procedure_eng_v1.2.docx