id: "PM-09" title: "Risk Management Strategy" family: "PM" family_name: "Program Management" sort_id: "pm-09" priority: "P1" implementation_level: "organization"
Develops a comprehensive strategy to manage:
Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and
Privacy risk to individuals resulting from the authorized processing of personally identifiable information;
Implement the risk management strategy consistently across the organization; and
Review and update the risk management strategy {{ insert: param, pm-09_odp }} or as required, to address organizational changes.
Guidance
An organization-wide risk management strategy includes an expression of the security and privacy risk tolerance for the organization, security and privacy risk mitigation strategies, acceptable risk assessment methodologies, a process for evaluating security and privacy risk across the organization with respect to the organization’s risk tolerance, and approaches for monitoring risk over time. The senior accountable official for risk management (agency head or designated official) aligns information security management processes with strategic, operational, and budgetary planning processes. The risk executive function, led by the senior accountable official for risk management, can facilitate consistent application of the risk management strategy organization-wide. The risk management strategy can be informed by security and privacy risk-related inputs from other sources, both internal and external to the organization, to ensure that the strategy is broad-based and comprehensive. The supply chain risk management strategy described in PM-30 can also provide useful inputs to the organization-wide risk management strategy.
Assessment Objective: a comprehensive strategy is developed to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems;
Assessment Objective: a comprehensive strategy is developed to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information;
Assessment Objective: the risk management strategy is implemented consistently across the organization;
Assessment Objective: the risk management strategy is reviewed and updated {{ insert: param, pm-09_odp }} or as required to address organizational changes.
Information security program plan
privacy program plan
risk management strategy
supply chain risk management strategy
procedures addressing the development, implementation, review, and update of the risk management strategy
risk assessment results relevant to the risk management strategy
other relevant documents or records
Organizational personnel with information security and privacy program planning and plan implementation responsibilities
organizational personnel responsible for the development, implementation, review, and update of the risk management strategy
organizational personnel with information security and privacy responsibilities
Organizational processes for the development, implementation, review, and update of the risk management strategy
mechanisms supporting the development, implementation, review, and update of the risk management strategy