4.4.3.3
Cyber Security Risk Assessment
Documentation and Authorization of Accepted Risks
Inherent and residual cyber security risks accepted by the organization shall be documented and authorized by a senior official of the organization.
-
5.31 Legal, Statutory, Regulatory and Contractual Requirements: Identify, document, and update legal, statutory, regulatory, and contractual requirements relevant to information security and the organization’s compliance approach.
-
3.11.1 Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
3.11.3 Remediate vulnerabilities in accordance with risk assessments.
3.12.2 Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
-
3.11.1 Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
3.11.3 Remediate vulnerabilities in accordance with risk assessments.
3.12.2 Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.