GOV-03 Security risk management assurance
1 action under this Govern principle in Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Security risk management activities for an organisation and their systems (infrastructure, operating systems, applications and data) are embedded into organisational risk management frameworks and subject to ongoing monitoring and assurance activities by the board of directors or executive committee.
Quoted as published. Everything else on this page is written by Control Stack.
- Function
- Govern
- Domains
The action
- IT.GOV-03.1Assess and Treat Cyber Security Risks Using an Approved Methodology and Plan
Maintains an approved method and plan, and uses them to rate each cyber security risk, choose a response and carry it out.
Domains:Governance and culture
Back to the full ASD Essentials for enterprise IT action list, or browse the complete control library.