Risk Assessment Policy

Purpose

The purpose of this policy is to ensure compliance with applicable federal and state laws and regulations, protect the confidentiality, integrity, and availability of the University’s IT Resources, and support informed decisions regarding information security Risk Management. 

Scope

This IT security policy, and all policies referenced herein, shall apply to all members of the University community, including faculty, students, administrative officials, staff, alumni, authorized guests, delegates, and independent contractors (the “User(s)” or “you”) who use, access, or otherwise employ, locally or remotely, the University’s IT Resources, whether individually controlled, shared, stand-alone, or networked. 

Policy Statement

• The Senior Director of IT Security and Assurance (or designees) is authorized to perform periodic information security Risk Assessments to identify threats, vulnerabilities, and potential impacts, and to recommend appropriate risk treatment.
• The University must maintain an Information Security Risk Management (ISRM) program to identify, assess, document, track, and manage information security risks.
• The Senior Director of IT Security and Assurance must oversee the ISRM program and coordinate the development and maintenance of relevant program policies, procedures, standards, and reports.
• The ISRM program must consider University priorities, staffing, budget, and the potential impact of information security risks on University IT Resources.
• Each Risk Assessment must use a documented, systematic method to evaluate the likelihood and impact of identified risks, determine Inherent Risk, consider the effectiveness of existing Controls, and determine Residual Risk where applicable.
• Risk Assessments must identify and prioritize, for management, information security risks based on their likelihood and potential impact. 
• Assessment results must inform risk treatment recommendations and prioritize implementing Controls.
• Risk Assessments must be conducted periodically, and when significant changes to IT Resources, threats, vulnerabilities, or security requirements may materially affect the University’s risk exposure.
• Risk Assessment documentation must identify the assessed IT Resources or activity, identified risks, existing Controls, risk ratings, recommended treatment, and the responsible University stakeholder or risk owner, as applicable.
• Risk treatment decisions, including mitigation, acceptance, avoidance, or transfer, must be documented. Risk acceptance must be made by an authorized University decision-maker. 
• Identified risks requiring treatment must be tracked, with documented action owners, planned actions, and status updates. Risk treatment progress and material changes in risk exposure must be reviewed as appropriate.
• Risk Assessment results and supporting records must be protected against unauthorized access and retained. 

Definitions

Control is a safeguard, process, or procedure implemented to reduce the likelihood or impact of risk. 

Inherent Risk is the level of risk before considering the effectiveness of Controls.

IT Resources include computing, networking, communications, applications, and telecommunications systems, infrastructure, hardware, software, data, databases, personnel, procedures, physical facilities, cloud-based vendors, Software as a Service (SaaS) vendors, and any related materials and services. 

Information Security Risk Management (ISRM) is the program through which information security risks are identified, assessed, documented, tracked, and managed to inform remediation and resource planning. 

Risk Assessment is the systematic process of identifying and analyzing information security risks based on their likelihood and potential impact. 

Risk Management is the ongoing process of assessing, treating, monitoring, and communicating information security risks.

Residual Risk is the level of risk remaining after the effectiveness of applicable Controls. 

Risk Treatment is the documented decision to mitigate, accept, avoid, or transfer an identified risk. 

NIST SP 800-53 Rev. 5 Control

• Risk Assessment: RA-1 Policy and Procedures; RA-3 Risk Assessment; RA-5 Vulnerability Monitoring and Scanning; RA-7 Risk Response.
• Program Management: PM-9 Risk Management Strategy; PM-28 Risk Framing.
• Assessment, Authorization, and Monitoring: CA-5 Plan of Action and Milestones; CA-7 Continuous Monitoring.
• System and Information Integrity: SI-2 Flaw Remediation. 

Related Policies and Procedures

• Patch Management Policy
• Vulnerability Management Policy

Implementation Information

Revision History

Policy Disclaimer Statement

Deviations from policies, procedures, or guidelines published and approved by Information Security and Assurance (ISA) may only be done cooperatively between ISA and the requesting entity with sufficient time to allow for appropriate risk analysis, documentation, and possible presentation to authorized University representatives. Failure to adhere to ISA written policies may be met with University sanctions.