CC9.1
CC9.1
The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.
Category
Security
Subcategory
Risk Mitigation
Points of Focus
Considers Mitigation of Risks of Business Disruption
Risk mitigation activities include the development of planned policies, procedures, communications, and alternative processing solutions to respond to, mitigate, and recover from incidents that disrupt business operations. Those resilience policies and procedures include monitoring processes, information, and communications to support the achievement of the entity's objectives during response, mitigation, and recovery efforts.
Considers the Use of Insurance to Mitigate Financial Impact Risks
The risk management activities consider the use of insurance to offset the financial impact of loss events that would otherwise impair the ability of the entity to support the achievement of its objectives.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Business Continuity | Continuity of Operations Plan (COOP) | Documented evidence of a Continuity of Operations Plan (COOP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. This involves internal and external stakeholders for incident response, disaster recovery and business continuity support requirements. |
| Risk Management | Risk Management Program (RMP) | Documented evidence of a Risk Management Program (RMP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Risk Management | Cybersecurity Risk Assessment (RA) | Documented evidence of a cybersecurity-specific risk assessment. |
| Risk Management | Risk Catalog | Documented evidence of a risk catalog. |
| Third-Party Management | Third-Party Service Reviews | Documented evidence of a formal, annual stakeholder review of third-party services for each Third-Party Service Provider (TSP). |
| Third-Party Management | Third-Party Terms & Conditions | Documented evidence of terms and conditions for external systems. |
| Third-Party Management | Third-Party Criticality Assessment | Documented evidence of third-party criticality assessment that evaluates the critical nature of each third-party the organization works with. |
| Risk Management | Supply Chain Risk Management (SCRM) Plan | Documented evidence of a Supply Chain Risk Management (SCRM) Plan. This is program-level documentation in the form of a playbook, concept of operations or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Third-Party Management | Third-Party Contracts | Documented evidence of third-party contractual obligations for cybersecurity & data privacy protections. |
| Third-Party Management | Break Clauses | Documented evidence of "break clauses" in third-party contracts. |
| Asset Management | Geolocation Inventory | Documented evidence of designated internal and third-party facilities where organizational data is stored, transmitted and/or processed. |
| Third-Party Management | System Connection or Processing Agreements | Documented evidence of system connection or processing agreements. |
| Threat Management | Threat Intelligence Program (TIP) | Documented evidence of a formal capability that intakes and analysis threat information to determine specific threat to the organization and necessary actions to mitigate the threat(s). |
| Threat Management | Threat Catalog | Documented evidence of a threat catalog. |
Policies
- Risk Management Standard - Establishes the framework for identifying, assessing, and managing information security risks
Example Organization Controls
- CC9.1.1 - A business continuity plan is documented and outlines the range of disaster scenarios and steps that the business will take to ensure the resumption of critical business operations.
- CC9.1.2 - Documented policies and procedures are in place to guide personnel in the identification, selection, and development of risk management activities for risks arising from potential business disruptions.
- CC9.1.3 - A risk assessment is performed on an annual basis that considers risks arising from potential business disruptions. Identified risks are rated using a risk evaluation process and are formally documented with mitigation strategies.
- CC9.1.5 - Risk mitigation activities include the use of insurance to offset the financial impact of loss events that would otherwise impair the ability of the entity to meet its objectives.
Example Control Objectives
- Business continuity preparedness - Business continuity and disaster recovery plans are documented and tested to ensure service availability.
Example Evidence
- Annual Risk Assessment Report - Annual risk assessment covering objectives, fraud, change, and business disruption risks with documented ratings and mitigation strategies
- Business Continuity Plan - Documented business continuity plan outlining disaster scenarios and steps to resume critical business operations
- Cyber Liability Insurance Certificate - Insurance certificate showing use of insurance to offset the financial impact of loss events