PM-9—Risk Management Strategy
>Control Description
Develops a comprehensive strategy to manage:
Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and
Privacy risk to individuals resulting from the authorized processing of personally identifiable information;
Implement the risk management strategy consistently across the organization; and
Review and update the risk management strategy ⚙organization-defined frequency or as required, to address organizational changes.
>Cross-Framework Mappings
>Supplemental Guidance
An organization-wide risk management strategy includes an expression of the security and privacy risk tolerance for the organization, security and privacy risk mitigation strategies, acceptable risk assessment methodologies, a process for evaluating security and privacy risk across the organization with respect to the organization's risk tolerance, and approaches for monitoring risk over time. The senior accountable official for risk management (agency head or designated official) aligns information security management processes with strategic, operational, and budgetary planning processes. The risk executive function, led by the senior accountable official for risk management, can facilitate consistent application of the risk management strategy organization-wide.
The risk management strategy can be informed by security and privacy risk-related inputs from other sources, both internal and external to the organization, to ensure that the strategy is broad-based and comprehensive. The supply chain risk management strategy described in PM-30 can also provide useful inputs to the organization-wide risk management strategy.
>Related Controls
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What is the process for developing and maintaining the organization's risk management strategy?
- •How does the risk management strategy integrate with organizational strategic planning and decision-making?
- •Who reviews and approves the risk management strategy?
- •How is the risk management strategy communicated and implemented across the organization?
- •What governance exists for updating the risk management strategy in response to changing threat environments?
Technical Implementation:
- •What systems or tools support organizational risk management?
- •How are risk data collected, analyzed, and reported at the enterprise level?
- •What integration exists between risk management and other security tools?
Evidence & Documentation:
- •Provide the organizational risk management strategy document.
- •Provide evidence of risk management strategy review and approval.
- •Provide documentation of strategy integration with organizational planning.
- •Provide records of risk management strategy updates.
- •Provide evidence of strategy communication across the organization.
Ask AI
Configure your API key to use AI features.