Description
a. Appoint a Senior Accountable Official for Risk Management to align information security and privacy management processes with strategic, operational, and budgetary planning processes; and b. Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.
Supplemental Guidance
The senior accountable official for risk management leads the risk executive (function). The risk executive (function) coordinates with senior leadership of the organization to: provide a comprehensive, organization-wide, holistic approach for addressing risk; provide oversight of all risk management-related activities across the organization; and ensure that risk-related considerations for individual systems are viewed from an organization-wide perspective.
Changes from Rev 4
New control in Rev 5. Risk management leadership formalized.