top of page

Principle 4

RISK-INFORMED SYSTEM

Agree on a Risk Assessment Interval

The risk assessment process should be performed according to an agreed-on interval with its results regularly evaluated.

SEC Regulation S–K Item 106(b)—Risk Management and Strategy


2023 NACD Director’s Handbook on Cyber-Risk Oversight Principle 5


2023 Draft NIST CSF 2.0 ID.RA, ID.IM


2017 AICPA CRMP Description Criteria DC11, DC12, DC15

bottom of page