Assessment Objective
Determine if:
- PM-29a.
- PM-29a.[01] a Senior Accountable Official for Risk Management is appointed;
- PM-29a.[02] a Senior Accountable Official for Risk Management aligns information security and privacy management processes with strategic, operational, and budgetary planning processes;
- PM-29b.
- PM-29b.[01] a Risk Executive (function) is established;
- PM-29b.[02] a Risk Executive (function) views and analyzes risk from an organization-wide perspective;
- PM-29b.[03] a Risk Executive (function) ensures that the management of risk is consistent across the organization.
Assessment Methods
Examine
- Information security program plan
- privacy program plan
- risk management strategy
- supply chain risk management strategy
- documentation of appointment, roles, and responsibilities of a Senior Accountable Official for Risk Management
- documentation of actions taken by the Official
- documentation of the establishment, policies, and procedures of a Risk Executive (function)
Interview
- Senior Accountable Official for Risk Management
- chief information officer
- senior agency information security officer
- senior agency official for privacy
- organizational personnel with information security and privacy program responsibilities
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | PM-29 Risk Management Program Leadership Roles |