SKIP TO PAGE CONTENT

RA-3 Risk Assessment

Last Review: 10/1/22

Statement

WTAMU shall perform and document risk assessments and make and document risk management decisions in compliance with Texas Administrative Code 202.25, & 202.27.

Applicability

This Control applies to all West Texas A&M network information resources. The intended audience for this Control includes all information resource owners, custodians, and users of information resources.

Implementation

  • A Risk assessment shall be conducted by system administrations, shared with system owners, in conjunction with the information security officer. 
  • Assessments shall include the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system and the information it processes, stores, or transmits.
  • Risk assessment results, vulnerability reports, and similar information shall be documented and presented to the CIO. The CIO, as the representative of the University President shall make the final risk management decisions to either accept exposures or protect the data according to its value/sensitivity.
  • The assessment data will also be used in developing the University security plan by the ISO and CIO.  This plan will be presented to senior administration, and the President of the University.
  • Risk assessments shall be performed annually or whenever there are significant changes to the information system or environment of operation, or other conditions that may impact the security state of the system.

Phone
Twitter
Facebook
Instagram
Mail