+DER.3.1.A19 Revision of the Risk Treatment Plan [Audit Team] (S)

DER.3.1.A19 Revision of the Risk Treatment Plan [Audit Team] (S)

The Audit Team SHOULD check that the remaining residual risks are appropriate and acceptable for the information domain concerned. It SHOULD also check whether the organisation's Top Management has acknowledged its acceptance of these risks in a binding manner. Safeguards that fundamentally support the information security of the entire organisation MUST NOT be included in this assumption of risk.

The auditor SHOULD verify at random whether and to what extent the safeguards defined in the risk treatment plan have been implemented.

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.29 Violations of Laws or Regulations