COI Report – Part VII
Page
217 of
425 42.1.3 Classified information provided by commercial companies to their trusted partners........................................................................................................... 336 42.1.4 Classified information provided by security partners in other countries ....... 337 Partnerships with ISPs should be strengthened ........................................... 337 Defence beyond borders – cross-border and cross-sector partnerships should be strengthened ............................................................................................ 337 Using a network to defend a network should be explored ........................... 338
43RECOMMENDATION #8: IT SECURITY RISK ASSESSMENTS AND AUDIT PROCESSES MUST BE TREATED SERIOUSLY AND CARRIED OUT REGULARLY. 34043.1
Risk assessments must be conducted at critical junctures ........................... 340
43.1.1 IT security risk assessments must be conducted on CII and mission-critical systems annually and upon specified events ................................................... 340 43.1.2 A written cybersecurity risk management framework must be established .... 341 43.1.3 Risks must be thoughtfully identified and prioritised during each assessment ...................................................................................................... 342 43.1.4 A clear process and methodology for cybersecurity risk assessment, and treatment and monitoring of cybersecurity risk should be established, and staff must be trained on the same ........................................................................... 343 43.1.5 A policy should be established fora comprehensive risk register to be maintained and updated after every risk assessment ..................................... 346 43.1.6 Senior management should be responsible for and clearly articulate the organisation’s risk appetite ............................................................................ 347 Audit action items must be remediated ........................................................ 348
43.2.1 Regular audits on CII systems must be conducted by an independent third Share with your friends: 
