Information Technology Governance Framework

IT Risk Management IT Risk Management is a continues process of identifying, analyzing, responding, monitoring, and reviewing risks related to IT from process, technology and people perspectives. In order to manage IT risks, Member Organizations should continually identify, assess and reduce IT risks within levels of tolerance set by the Member Organization's senior management. 3.2.1 Managing IT Risks Principle IT Risk Management process should be defined, approved, implemented, communicated and aligned to the Member Organization's Enterprise Risk Management process, including the identification, analysis, treatment, monitoring and review of IT risks at appropriate intervals. Control Requirements 1. IT risk management process should be defined, approved, implemented and communicated. 2. The effectiveness of the IT risk management process should be measured and periodically evaluated. 3. IT risk management process should be aligned with the Member Organization's enterprise risk management process. 4. IT risk management process should clearly address the following sub processes, including but not limited to: a. risk identification, analysis and classification; b. risk treatment; c. risk reporting; and d. risk monitoring and profiling. 5. IT risk management process should address Member Organization's information assets, including but not limited to: a. business processes and related data; b. business applications; c. infrastructure components; and d. Third party relationships and associated risks. 6. IT risk management process should address Member Organization's people aspect (i.e. permanent staff, contractual employees, third party). 7. IT risk management process should be initiated at, but not limited to: a. an early stage of the program and project implementation; b. prior to initiate critical and major changes to the information assets; c. the time of outsourcing services; and d. prior to procuring of new systems, tools and emerging technologies (i.e. Distributed Ledger Technology (DTL), Robotic Process Assurance (RPA)etc.) 8. Existing information assets should be subject to periodic IT risk assessment based on their criticality such as: a. all mission critical and critical information assets should be assessed at least once a year; and b. non-critical information assets should be assessed based on their importance to the business. 9. IT risk management activities should involve the following stakeholders, but not limited to: a. business owners and users; b. IT departmental/functional heads; c. technical administrators; and d. cyber security specialists. 10. The Member Organization's should develop and implement IT risk response (i.e. avoid, mitigate, transfer and accept) and control strategies that are consistent with the value of the information assets and member organizations risk appetite. 11. IT key risk indicators (KRIs) should be defined, implemented and monitored. 3.2.2 Risk Identification and Analysis Principle Information assets should be identified, recorded and maintained to gather information about related threats, existing controls and associated risks should be analyzed based on their likelihood of occurrences and resulting impact. Control Requirements 1. IT risk identification should be performed, documented and periodically updated in the formal centralized risk register. 2. IT risk register should be regularly updated. 3. IT risk analysis should address the following, but not limited to: a. information asset description and classification; b. potential threat(s) to the information asset; c. impact and likelihood; d. existing IT controls; e. risk owner (business or process owner); f. implementation owner (control owner); and g. inherent as well as residual risks related to the information assets.