COI Report – Part VII
Page
346 of
425 43.1.5 A policy should be established fora comprehensive risk register to be maintained and updated after every risk assessment 1001. The CCoP requires CII owners to maintain a list of all cybersecurity risks identified, byway of a risk register in respect of each CII. CII owners shall ensure all identified cybersecurity risks listed are monitored regularly with a view to ensuring that the organisation’s thresholds or limits for risks are not breached. The risk register shall be updated after every cybersecurity risk assessment. A risk register shall document the following a) Date the risk is identified b) Description of the risk c) Likelihood of occurrence d) Severity of the occurrence e) Risk treatment f) Risk owner g) Status of risk treatment and h)
Residual risk, which is defined in the CCoP as “
the risk exposure after risk mitigating controls are considered or applied”.
1002. While the HITSPS provides for
an IT security risk register, the policy is inadequate, when compared against the requirements under the CCoP.
1003. We recommend that a policy be put in place that establishes a) the requirement fora comprehensive risk register, documenting
the items set out in the CCoP, in respect of each CII and mission- critical system on which a risk assessment is done
