+DER.3.1.A19 Revision of the Risk Treatment Plan [Audit Team] (S)

DER.3.1.A19 Revision of the Risk Treatment Plan [Audit Team] (S)

The Audit Team SHOULD check that the remaining residual risks are appropriate and acceptable for the information domain concerned. It SHOULD also check whether the organisation's Top Management has acknowledged its acceptance of these risks in a binding manner. Safeguards that fundamentally support the information security of the entire organisation MUST NOT be included in this assumption of risk.

The auditor SHOULD verify at random whether and to what extent the safeguards defined in the risk treatment plan have been implemented.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.29 Violations of Laws or Regulations