+DER.3.1.A19 Revision of the Risk Treatment Plan [Audit Team] (S)

DER.3.1.A19 Revision of the Risk Treatment Plan [Audit Team] (S)

The Audit Team SHOULD check that the remaining residual risks are appropriate and acceptable for the information domain concerned. It SHOULD also check whether the organisation's Top Management has acknowledged its acceptance of these risks in a binding manner. Safeguards that fundamentally support the information security of the entire organisation MUST NOT be included in this assumption of risk.

The auditor SHOULD verify at random whether and to what extent the safeguards defined in the risk treatment plan have been implemented.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.29 Violations of Laws or Regulations