SUMMARY
Risk management involves the practice of addressing and handling threats to the organization in the form of cybersecurity attacks and compromised or lost data. The process of establishing appropriate risk management guidelines is critical to ensure company operations and reputation do not suffer adverse impacts.

It’s not an easy process, achieving a sound risk management foundation, because of all the moving parts involved: Users, systems, network, data, remote or cloud locations, and other elements can produce a level of complexity difficult to tame. The approach must involve both the overall “forest” and individual “trees.”

PURPOSE
The purpose of this policy is to provide guidelines for establishing and maintaining appropriate risk management practices.

This policy can be customized as needed to fit the needs of your organization.

From the policy:

ESTABLISH KEY PLAYERS
Key players for risk management should be identified and established. Who will implement the guidelines, who will be responsible for educating the user community, who will maintain any procedural or technological controls, who will handle incident investigations and responses, and who will update/modify this policy and its tenets as appropriate?

Identify responsible individuals based on the criteria of the roles in the next section.