COR-1 - Risk Management and Cybersecurity Program
Strategic governance control for cybersecurity and organizational risk
Control Definition
An Information Security Management System must be created, defining its scope based on the organizational context and the needs of its stakeholders, and a cybersecurity lead must be appointed with roles, resources and a governance structure periodically reviewed by senior management. The management system's policies, processes and procedures must be documented, approved and communicated, and a risk management methodology must be implemented to identify and prioritize risks and assign each an owner and a treatment plan. Cybersecurity initiatives must be aligned with business objectives through a prioritized roadmap, their progress and management indicators must be reported periodically to senior management, and continuous improvement of the system must be driven by leadership.
Requirements
Requirement 1
We create the Information Security Management System (ISMS).
Requirement 2
We define the scope of the ISMS considering the context, the stakeholders and its connection with other organizations.
Requirement 3
We identify the internal, external and third-party factors that can affect the ISMS and the achievement of its goals.
Requirement 4
We identify the ISMS stakeholders.
Requirement 5
We identify the needs and expectations of the ISMS stakeholders.
Requirement 6
We determine which stakeholder needs and expectations will be addressed by the ISMS.
Requirement 7
We appoint a cybersecurity lead in the company.
Requirement 8
We define the roles and responsibilities or the RACI matrix of the ISMS.
Requirement 9
We ensure the ISMS has the resources it needs to operate.
Requirement 10
We create an information security policy that fits what the organization does and needs.
Requirement 11
We create an information security policy that includes clear security objectives or serves as a guide for defining them.
Requirement 12
We create an information security policy that includes a commitment to comply with all the rules, requirements and stakeholders defined by the organization.
Requirement 13
We create an information security policy that includes a commitment to continually improve the management system.
Requirement 14
We create and continually improve the documents on the company's policies.
Requirement 15
We create and continually improve the documents on the company's processes.
Requirement 16
We create and continually improve the documents on the company's procedures.
Requirement 17
We document the ISMS domains, controls and requirements.
Requirement 18
We approve, communicate and version the ISMS documents.
Requirement 19
We ensure stakeholders acknowledge and know the ISMS documents.
Requirement 20
We integrate the ISMS requirements into the organization's processes.
Requirement 21
We establish a procedure for the centralized management and collection of evidence for cybersecurity requirements and controls, ensuring its availability to stakeholders.
Requirement 22
We implement a risk management methodology.
Requirement 23
We declare the organization's risk appetite.
Requirement 24
We declare the organization's risk tolerance.
Requirement 25
We incorporate asset, threat and vulnerability valuation criteria into the risk methodology.
Requirement 26
We assign each risk an owner, a residual risk level and a treatment plan.
Requirement 27
We draw up a cybersecurity roadmap.
Requirement 28
We prioritize cybersecurity initiatives with owners and implementation dates.
Requirement 29
We align cybersecurity initiatives with business objectives.
Requirement 30
We record identified risks in a centralized repository.
Requirement 31
We review the governance structure annually and submit it for senior management approval.
Requirement 32
We hold security committees or report to senior management on a scheduled basis.
Requirement 33
We include in management reports and reviews the status of critical risks, roadmap progress, incident indicators, regulatory compliance, control performance, non-compliance trends, measurement and audit results, achievement of objectives, risk assessment results, progress on the risk treatment plan and progress on improvements.
Requirement 34
We define and track information security and cybersecurity OKRs.
Requirement 35
We define and track information security and cybersecurity KPIs.
Requirement 36
We continually improve the ISMS, and review and update its documents on a scheduled basis together with their stakeholders.
Requirement 37
Leadership drives the continuous improvement of the ISMS.