Risk management policy

The organization shall define and apply a privacy risk assessment process that establishes and maintains privacy risk criteria, including risk acceptance criteria and criteria for performing assessments; ensures that repeated assessments produce consistent, valid and comparable results; identifies the privacy risks associated with the processing of PII within the scope of the PIMS, both risks to the organization and risks to PII principals, and identifies the risk owners; analyses the risks by assessing the potential consequences and the realistic likelihood of their occurrence and determining the levels of risk; and evaluates the risks by comparing the results against the criteria and prioritising them for treatment. Where the organization also runs an information security risk assessment, the relationship between information security and the protection of PII shall be managed throughout. The organization shall retain documented information about the process. The first edition's dual assessment, information security risk plus privacy risk inside an ISMS, becomes a privacy risk assessment in its own right; the transition documents note the guidance draws on ISO/IEC 27557.

The organization shall define and apply a privacy risk treatment process that selects appropriate treatment options taking account of the assessment results; determines all controls necessary to implement the options; compares the determined controls with those in Annex A to verify that no necessary controls have been omitted, Annex A being a reference list of possible controls that the organization can add to; identifies and documents the information security programme that protects PII, which the transition documents record as required to address a stated set of areas and which may but need not follow ISO/IEC 27002; produces a Statement of Applicability that contains the necessary controls, the justification for their inclusion, whether they are implemented and the justification for excluding any Annex A control; formulates a privacy risk treatment plan; and obtains the risk owners' approval of the plan and their acceptance of the residual privacy risks. Documented information about the process shall be retained. In the first edition the comparison ran against ISO/IEC 27001:2013 Annex A and the two PIMS annexes; in this edition it runs against Annex A of this document alone.

Implement and maintain a risk assessment process that identifies the risks of disruption to the organization's prioritized activities and the resources they require, analyses and evaluates those risks, and determines which of them require treatment.

Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, enabling them to address ICT risk quickly, efficiently and comprehensively, reviewed at least annually and audited periodically by ICT-audit staff.

The first of the ten minimum measure categories requires both a method for analysing risk and the security policy set that the analysis feeds. Risk analysis has to be an actual repeatable method with criteria for assessing and accepting risk, applied to the network and information systems the entity relies on for its operations and for delivering its services, with results that are recorded and revisited. The information system security policies are the codified decisions that follow: what is protected, to what level, who owns each decision, and what happens when the policy cannot be met. Both limbs are needed. A risk register with no policy leaves nothing binding on the organisation, and a policy library with no risk analysis behind it cannot show why it says what it says.