Pls. see item no. 28. I think this document is in the public domain published by ISACA (published in IT Control journal in 2003), which I I find particularly useful.
As is the case with most of the risk response actions (based on the risk assessment), a policy is a very important/crtical preventative control tool to mitigate the risks. Incidentally, this is often neglected.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.
