Information security risk assessment
6.1.2
-
Last updated
Mandatory
Catalog reference
Define and apply a repeatable risk assessment process with clear criteria, that identifies information security risks, their owners, and analyses and evaluates them to produce consistent, comparable results.
Narrative — how we satisfy this requirement
Every Risk is scored for likelihood and impact on a five-point scale, and its Owner reviews the score every six months.
Review
On trackNext review is 10/27/2027 — no urgency right now.
- Review cadence
- Every 365 days
- Last reviewed
- Next review due