How to Complete a Risk Assessment in 5 Days or Less

104  ◾  How to Complete a Risk Assessment in 5 Days or Less

Table 5.3 Gap Analysis Example 1

Control

Compliant 

(Yes/No) Comment

A corporate information security officer

(CISO) or equivalent executive-level

authority has been named and is responsible

for implementing and maintaining an

effective organizationwide information

protection (IP) program.

The CISO has a team or department with

dedicated job responsibilities to IP activities

within the organization, including security

administration, awareness and training,

research, and incident investigations.

The IP program supports the business

objectives/mission statement of the

organization.

An enterprisewide ...