id: "PM-29" title: "Risk Management Program Leadership Roles" family: "PM" family_name: "Program Management" sort_id: "pm-29" priority: "P1" implementation_level: "organization"
Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and
Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.
Guidance
The senior accountable official for risk management leads the risk executive (function) in organization-wide risk management activities.
Assessment Objective: a Senior Accountable Official for Risk Management is appointed;
Assessment Objective: a Senior Accountable Official for Risk Management aligns information security and privacy management processes with strategic, operational, and budgetary planning processes;
Assessment Objective: a Risk Executive (function) is established;
Assessment Objective: a Risk Executive (function) views and analyzes risk from an organization-wide perspective;
Assessment Objective: a Risk Executive (function) ensures that the management of risk is consistent across the organization.
Information security program plan
privacy program plan
risk management strategy
supply chain risk management strategy
documentation of appointment, roles, and responsibilities of a Senior Accountable Official for Risk Management
documentation of actions taken by the Official
documentation of the establishment, policies, and procedures of a Risk Executive (function)
Senior Accountable Official for Risk Management
chief information officer
senior agency information security officer
senior agency official for privacy
organizational personnel with information security and privacy program responsibilities