Inherent Risk Level of risk before Risk Treatments (controls) are applied. This process includes the acceptance of the risk by the unit. Exception Process Process by which a unit documents where a requirement within the information security standards in the Information Security Policy cannot be met on an information technology resource. Data Information collected, stored, transferred or reported for any purpose, whether electronically or hard copy. Controls include practices, policies, procedures, programs, techniques, technologies, guidelines, and organizational structures. Controls are also known as safeguards or countermeasures. Control Any administrative, management, technical, or legal method that is used to prevent, detect or correct risks.

Assets can include data, software, hardware, network, data center. Units must share with University Information Security the results of risk assessments, and any associated risk treatment plans completed by parties other than University Information Security.Īsset Information or information technology that has value to the University or which requires protection to meet the University's legal or contractual obligations. Units must report updates to the risk treatment plan to the University CISO or designate. Risk assessments are performed on information assets, systems, processes and controls, based on risk criticality.Ĭollegiate and administrative units must identify all collections and uses of private data to University Information Security upon request, collaborate with the University CISO to complete information security risk assessments, and develop and implement a risk treatment plan. The University CISO develops an annual information security risk assessment plan in consultation with collegiate and administrative units.

The Information Security Risk Management program includes the process for managing exceptions to the Information Security policy and the risk acceptance process. The University Chief Information Security Officer (CISO) is responsible for managing the Information Security Risk Management program and coordinating the development and maintenance of program policies, procedures, and standards.

The University uses a formal Information Security Risk Management (ISRM) program that identifies risks and implements plans to address and manage them.

To protect the confidentiality, integrity, and availability of University of Minnesota data in compliance with applicable state and federal laws and regulations, the University of Minnesota has formal information security risk management processes.

Risk management policy