Security expenditures and controls may be disproportionately or inconsistently applied. Security measures may be ineffective. Risks are assessed and security needs determined. Security is centrally managed. Appropriate policies and related controls are implemented.
Awareness is promoted.
The effectiveness of the policies and controls are monitored and evaluated. Control Activity Risks are periodically assessed and security plans developed. Risk assessments are documented. Risk assessments consider data sensitivity. Risk assessments consider the range of risks to the entity's systems and data.