Appropriate policies and related controls are implemented. Awareness is promoted. The effectiveness of the policies and controls are monitored and evaluated. Control Activity Risks are periodically assessed and security plans developed. Risk assessments are documented.
Risk assessments consider data sensitivity.
Risk assessments consider the range of risks to the entity's systems and data. A security plan is documented that addresses areas of high risk. The security budget is established based on the security plan. Related management approvals are documented and maintained on file. Review the most recent high-level risk assessment and evidence of related management approval.