Risk Assessment Policy

1. Overview

See Purpose.

2. Purpose

To empower Infosec to perform periodic information security risk assessments (RAs) to determine areas of vulnerability and initiate appropriate remediation.

3. Scope

Risk assessments can be conducted on any entity within eCuras or any outside entity that has signed a Third Party Agreement with eCuras. RAs can be performed on any information system, to include applications, servers, and networks, and any process or procedure by which these systems are administered and/or maintained.

4. Policy

The execution, development, and implementation of remediation programs is the joint responsibility of Infosec and the department responsible for the system area being assessed. Employees are expected to cooperate fully with any RA being conducted on systems they are held accountable for. Employees are further expected to work with the Infosec Risk Assessment Team to develop a remediation plan.

5. Policy Compliance

5.1  Compliance Measurement

The Infosec team will verify compliance with this policy through various methods, including but not limited to business tool reports, internal and external audits, and feedback to the policy owner.

5.2  Exceptions

The Infosec team must approve any exception to the policy in advance.

5.3  Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Revised: March 14th, 2018