RA-3 Risk Assessment
Last Review: 10/1/22
Statement
WTAMU shall perform and document risk assessments and make and document risk management decisions in compliance with Texas Administrative Code 202.25, & 202.27.
Applicability
This Control applies to all West Texas A&M network information resources. The intended audience for this Control includes all information resource owners, custodians, and users of information resources.
Implementation
- A Risk assessment shall be conducted by system administrations, shared with system owners, in conjunction with the information security officer.
- Assessments shall include the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system and the information it processes, stores, or transmits.
- Risk assessment results, vulnerability reports, and similar information shall be documented and presented to the CIO. The CIO, as the representative of the University President shall make the final risk management decisions to either accept exposures or protect the data according to its value/sensitivity.
- The assessment data will also be used in developing the University security plan by the ISO and CIO. This plan will be presented to senior administration, and the President of the University.
- Risk assessments shall be performed annually or whenever there are significant changes to the information system or environment of operation, or other conditions that may impact the security state of the system.