Has your organization established and communicated a formal risk management policy that clearly articulates management's intent, expectations, and direction?

A formal risk management policy serves as the foundation for an organization's approach to identifying, assessing, and mitigating security risks. It should clearly define roles and responsibilities, risk tolerance levels, assessment methodologies, and response procedures that align with business objectives. Without a well-defined policy, risk management efforts may be inconsistent, ineffective, or misaligned with organizational goals. Evidence of fulfillment could include a documented risk management policy that has been approved by leadership, communication records showing dissemination to relevant stakeholders, and documentation of periodic reviews or updates to ensure the policy remains current and applicable.