+DER.3.1.A19 Revision of the Risk Treatment Plan [Audit Team] (S)

DER.3.1.A19 Revision of the Risk Treatment Plan [Audit Team] (S)

The Audit Team SHOULD check that the remaining residual risks are appropriate and acceptable for the information domain concerned. It SHOULD also check whether the organisation's Top Management has acknowledged its acceptance of these risks in a binding manner. Safeguards that fundamentally support the information security of the entire organisation MUST NOT be included in this assumption of risk.

The auditor SHOULD verify at random whether and to what extent the safeguards defined in the risk treatment plan have been implemented.

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

Requisitos

3. Regulaciones relacionadas

Regulaciones

Incidencias vinculadas

Vínculos
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.29 Violations of Laws or Regulations