Find Resources & Connect with members on topics that interest you.

AI - Acquire and Implement

PO - Plan and Organize

DS - Deliver and Support

Please sign in to see your topics.

You must be logged in to join this group.

PO4.8 - Responsibility for Risk, Security and Compliance

This topic is intended to enable collaboration and sharing of information to facilitate a better understanding and approach to implementing this COBIT control objective based on the risk, value and guidance provided by its corresponding control practices.

COBIT Control Objective PO4.8 - Responsibility for Risk, Security and Compliance is contained within Process Popup Define the IT Processes, Organisation and Relationships

Learn more about COBIT and related publications.

Click “Join This Community” to be able to actively participate in discussions and contribute content. You must be an ISACA member to join this topic. Join ISACA now.

 
This Topic Has:
2 Members
0 Online
739 Visits

 Recent Discussions

Community Leader

Knowledge Center Manager

Knowledge Center Manager

Title: Become a Topic Leader!

Points: 3


Responsibility for Risk, Security and Compliance

Embed ownership and responsibility for IT-related risks within the business at an appropriate senior level. Define and assign roles critical for managing IT risks, including the specific responsibility for information security, physical security and compliance. Establish risk and security management responsibility at the enterprise level to deal with organisationwide issues. Additional security management responsibilities may need to be assigned at a system-specific level to deal with related security issues. Obtain direction from senior management on the appetite for IT risk and approval of any residual IT risks.

View value and Risk Drivers  help

Hide value and Risk Drivers help


Value Drivers

  • Improved protection and integrity of information assets
  • Risk, security and compliance responsibilities embedded at senior management level
  • Senior management support in risk, security and compliance issues
  • Security mechanisms as effective and efficient countermeasures for the organisation’s threats
  • Proactive identification and resolution of risk, security and compliance issues
  Risk Drivers
  • Improper protection of information assets
  • Loss of confidential information
  • Financial losses
  • Lack of management commitment for organisationwide security
  • Non-compliance risk
  • Unclear understanding of the organisation’s IT risk appetite

View Control Practices  help

Hide Control Practices  help

  1. Encourage senior management to establish an organisationwide, adequately staffed risk management and information security function with overall accountability for risk management and information security. The reporting line of the risk management and information security function is such that it can effectively design, implement and, in conjunction with line management, enforce compliance with the organisation’s risk management and information security policies, standards and procedures.
  2. Formalise and document roles and responsibilities for the risk management and information security function. Allocate these responsibilities to appropriately skilled and experienced staff and, in the case of information security, under the direction of an information security officer.
  3. Regularly assess the resource requirements in relation to risk management and information security. Assess whether appropriate resources are provided to meet the needs of the business.
  4. Put a process in place to obtain senior management guidance concerning the enterprise’s risk profile and acceptance of significant residual risks.

 

Discussions: 0 total

Must be a Topic member to contribute

No Results Found

Documents & Publications: 225 total

Must be a Topic member to contribute
View All »
Cobit Related
Posted by ISACA 223 days ago
Books
Posted by ISACA 11 days ago
Books
Posted by ISACA 13 days ago

Events & Online Learning: 12 total

7 May 2012
ISACA International Event
Orlando, Florida, USA
Get the knowledge you need to stay one step ahead of the competition and keep up with changing professional trends at ISACA’s North America CACS Conference.
14 May 2012
ISACA International Event
Chicago, IL, USA
15 May 2012
ISACA International Event
Washington, DC, USA
12 Jun 2012
ISACA International Event
Dallas, Texas, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
7 Aug 2012
ISACA International Event
Chicago, Illinois, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
10 Sep 2012
ISACA International Event
Munich, Germany
EuroCACS/ISRM is a multidimensional event featuring audit, security, governance and risk content, and the audit and security programs, tools and the resources you need to be responsive to industry changes.

Journal Articles: 708 total

Volume 2, 2019
by ISACA Member and Certification Holder Compliance
Volume 3, 2012
by Ookeditse Kamau, CISA, CIA
Quality evidence collected during the audit process enhances the overall quality of the work performed and significantly reduces audit risk.
Volume 3, 2012
by Steven J. Ross, CISA, CISSP, MBCP
To accelerate investments in security, we security professionals must do a better job of communicating the reality of the threats that our organizations face.
Volume 3, 2012
by Tommie W. Singleton, Ph.D., CISA, CGEIT, CITP, CPA
This two-part article describes one framework for performing effective audits of applications.
Volume 3, 2012
by Steve Markey
Once thought of as a technology solely for academia, non-RDBMS are now reaching critical mass in industry.
Volume 3, 2012
by Brian Vazzana, CISA, CITP, CPA
SOC reports examine the controls present at the service organizations and consider how those controls are designed and operate.

Wikis: 2 total

Blog Posts: 154 total

On the AS/400 (System i) it is possible to audit for default passwords using the ANZDFTPWD command. A default password is defined as a password which is the same as the user profile. The command behaves slightly differently depending on the value of the s...
Posted By : Ian Cooke | 0 comments
Having been associated with the BS 7799 from its introduction as a Security Standard, and as a Contributor to the ISO 27001, and the last and final Chair of the ISO 27001 at the Department of Trade and Industry (DTI) I have been a long term supporter, and...
Posted By : John379 | 0 comments
Gone are the days of check list auditing (Tick and bash audit). To add value to business auditors need to go beyond check listing. Be it an application control review (ACR), IT General Controls Review (ITGCR), A project review or an integrated audit, i...
Posted By : Tichaona Zororo CISA, CISM, CRISC, CGEIT | 0 comments
During my audits, training & teaching sessions one of the frequent queries I came across is 'Sir, How do I become an IT Auditor? What are the qualification criteria?' The best answer for this to quote from the famous book, Information Systems Control and ...
Posted By : KvR | 0 comments
We are in the year 2012 – the year of the UK Olympics, and the prospect of good times, fantastic events, and on mass tourism is something the UK is liking forward to, and embracing – but like all good things, there can be baggage, and in this case that ma...
Posted By : John379 | 0 comments
On my latest IT Grackle Post, "Mobile Security By The Numbers," I repost an IBM Infographic about mobile device security and its intersection with "Bring Your Own Device" policies. I also post a question about a missing element from their mobile device se...
Posted By : Calvin Powers | 0 comments