Give each risk an owner and a plan.
Record information security risks, assess their significance, assign an owner and maintain treatment decisions as your organisation changes.
Illustrative record
Unauthorised access to customer information
- Owner
- IT Manager
- Treatment
- Strengthen access controls and review permissions
- Next review
- Quarterly risk assessment