Question - Policy as the only Control?

Forum - Software
#1

We have a small number of risks which are mitigated only by policy and procedure.

When “mitigate” is selected as the Risk Treatment method the Compensating Controls field becomes mandatory.

This means in order to successfully mitigate the risk (as Eramba sees it) I must make certain policies and procedures both Security Policies and Security Services.

Is this normal practice in these circumstances or am I missing something?

#2

Those fields are configurable, please have a look at the risk doc: https://docs.google.com/document/d/1sGaUiS6fR_oYun6mt7FktSQOdOJ0huXshMBBMOr_4N0/edit#heading=h.5wqy5pm2egxf

that should help!

1 Like