Statement

The University shall develop an organization-wide risk management strategy includes an expression of the security and privacy risk tolerance for the organization, security and privacy risk mitigation strategies, acceptable risk assessment methodologies, a process for evaluating security and privacy risk across the organization with respect to the organization’s risk tolerance, and approaches for monitoring risk over time.  

Applicability

This Control applies to all West Texas A&M network information resources. The intended audience for this Control includes all information resource owners, custodians, and users of information resources.

Implementation

WTAMU shall:

1. Develop a comprehensive strategy to manage:
   1. Security risk to organizational operations and assets, individuals, other organizations, the State of Texas, and the Nation associated with the operation and use of organizational systems; and
   2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information.
2. Implement the risk management strategy consistently across the organization; and
3. Review and update the risk management strategy annually or as required to address organizational changes.