If changes to existing critical business processes or new critical business processes were identified, proceed to step 1, else proceed to step 5; and Agency / Organization Security Manager shall communicate the changes in the organization to the Information Security Steering / Governance Committee and initiate information security risk Output Continual alignment of the management of information security risks with the organization’s business objectives, and with risk acceptance criteria; and Factors / communication to initiate the risk management process Roles and Responsibilities Process Risk Subject Security Information Security IT Information Risk Step ref Assessor Matter Manager Steering / Governance Manager Asset/ Owner Expert Committee Service (SME) Owner 23 S A R S S R 24 R C S I C A Refer to Section 6 Definitions RASCI – – References Qatar National Cyber Security Strategy Qatar National Information Assurance Framework (NIAF) Qatar National Information Assurance (NIA) Policy Template Qatar National Information Classification (NIC) Policy Template IEC/ISO Information Security Risk Management Standard – Acronyms Information Security Risk Management Framework ISRM Information Security Risk Management ISRR Information Security Risk Register IRV Inherent Risk Value RR Residual Risk Security Manager SM
If changes to existing critical business processes or new critical business processes were identified, proceed to step 1, else proceed to step 5; and Agency / Organization Security Manager shall communicate the changes in the organization to the Information Security Steering / Governance Committee and initiate information security risk Output Continual alignment of the management of information security risks with the organization’s business objectives, and with risk acceptance criteria; and Factors / communication to initiate the risk management process Roles and Responsibilities Process Step ref Risk Assessor Subject Matter Expert (SME) Security Manager Information Security Steering / Governance Committee IT Manager Information Asset/ Service Owner Risk Owner 23 S A R S S R 24 R C S I C A Refer to Section 6 – Definitions – RASCI References Qatar National Cyber Security Strategy Qatar National Information Assurance Framework (NIAF) Qatar National Information Assurance (NIA) Policy Template Qatar National Information Classification (NIC) Policy Template IEC/ISO – Information Security Risk Management Standard Acronyms Information Security Risk Management Framework ISRM Information Security Risk Management ISRR Information Security Risk Register IRV Inherent Risk Value RR Residual Risk SM Security Manager
cs-information_security_risk_management_procedure_eng_v1.2.docx