Managing Risk in Information Systems, 3rd Edition

Following Up on the Risk Mitigation Plan

An important part of management is follow-up to ensure that plans are implemented as expected, and the risk management plan is no exception. When following up on risk mitigation plans, the following two elements should be included:

• Ensuring countermeasures have been implemented
• Ensuring security gaps have been closed

Ensuring Countermeasures Have Been Implemented

The primary tool used to ensure countermeasures are implemented is the POAM. The POAM is created with the risk assessment, but it is a living document because managers update it regularly. As the risk assessment transforms into a risk mitigation plan, the POAM document expands.

The POAM includes all the approved countermeasures and their ...