3.11.3

4.4.2.1 Complete the “Cyber Security Risk Assessment Questionnaire” found in Annex B

4.4.3.1 The member of the senior-level leadership team appointed to oversee the organization’s IT security shall conduct cyber security risk assessments and coordinate the implementation of cyber security controls to address potential cyber security risks.

4.4.3.2 The organization shall develop and maintain a list of their information systems and assets. For any information systems and assets not included in their implementation of the baseline cyber security controls, the organization shall document all instances where they make the business decision not to do so.

4.4.3.3 Cyber security risks accepted by the organization shall be documented and authorized by a senior official of the organization.

4.4.3.4 The organization shall identify their financial spending levels for IT and IT security investment (as raw numbers and as a percent of total expenditures).

4.4.3.5 The organization shall identify their internal staffing levels for IT and IT security (as raw numbers and as a percent of total staff).

4.4.3.6 The organization shall commit to progressive improvements to cyber security.

4.4.3.7 The organization shall determine triggers and thresholds to conduct a new or update an existing cyber security risk assessment.

4.4.3.8 Regardless of the outcomes from the cyber security risk assessment, the organization shall implement the foundational or baseline cyber security controls specified in Section 5, and as appropriate, Section 6 based on its business environment.

4.4.3.9 The organization shall periodically review and/or test cyber security controls to ensure effectiveness. Testing and/or review shall take place at a minimum annually, or if a major change occurs in their system.