Risk mgmt policy

What IT framework your company is adopting?

You can check?ÿISACA site for reference:

www.isaca.org/Knowledge-Center/Research/...sk-IT-Framework.aspx

hi. we based on COBIT, but some areas are not applicable to us. but?ÿhow is the framework going to help in my risk mgmt policy?

Type of IT Framework to adopt is decide by your CTO or Management. They should have their reasons for adopting during their evaluation process. You might want to check with them.

If you think Cobit 5 v2 don't cover your needs or in-deep; you can take a look others and recommend to management:

Examples:

CISSP, ITIL, OCTAVA, RMF, TARA, FAIR etc.

Without diagnosing or understand your company area of risk or weakness, any risk policies created will have gap.

 

cool, will check with my mgmt. i also understand there's a need to create a risk assessment template within the policy to identify all the potential risks, residual risks ,etc.. is this necessary to create at this juncture?

Not at the moment.?ÿYou need them for you risk assessment report.

RA is important, i was faulted by mgmt for failing to do a proper one. =(