PM-9

PM-9 RISK MANAGEMENT STRATEGY

Overview

Number	Title	Impact	Priority	Subject Area
PM-9	Risk Management Strategy			Program Management

Instructions
The organization: PM-9a. Develops a comprehensive strategy to manage risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems; PM-9b. Implements the risk management strategy consistently across the organization; and PM-9c. Reviews and updates the risk management strategy Assignment: organization-defined frequency or as required, to address organizational changes.

Instructions

The organization:

PM-9a.

Develops a comprehensive strategy to manage risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems;

PM-9b.

Implements the risk management strategy consistently across the organization; and

PM-9c.

Reviews and updates the risk management strategy Assignment: organization-defined frequency or as required, to address organizational changes.

Guidance
An organization-wide risk management strategy includes, for example, an unambiguous expression of the risk tolerance for the organization, acceptable risk assessment methodologies, risk mitigation strategies, a process for consistently evaluating risk across the organization with respect to the organization�s risk tolerance, and approaches for monitoring risk over time. The use of a risk executive function can facilitate consistent, organization-wide application of the risk management strategy. The organization-wide risk management strategy can be informed by risk-related inputs from other sources both internal and external to the organization to ensure the strategy is both broad-based and comprehensive.

Guidance

An organization-wide risk management strategy includes, for example, an unambiguous expression of the risk tolerance for the organization, acceptable risk assessment methodologies, risk mitigation strategies, a process for consistently evaluating risk across the organization with respect to the organization�s risk tolerance, and approaches for monitoring risk over time. The use of a risk executive function can facilitate consistent, organization-wide application of the risk management strategy. The organization-wide risk management strategy can be informed by risk-related inputs from other sources both internal and external to the organization to ensure the strategy is both broad-based and comprehensive.

Enhancements