organizationSubject
Organization
The organization as a whole. Signals here describe a program, policy or control state that belongs to no single person, such as whether incident exercises run or whether user activity is baselined.
Example
The organization ran an incident response exercise in the last 12 months.
Indicators (24, first 20 shown)
20- Fails to maintain adequate audit trails for sensitive data access I.0412
- Allows circumvention of secure web gateways I.0413
- Fails to require acknowledgement of acceptable use policies I.0414
- Does not review or address security training gaps I.0415
- Fails to regularly audit access to regulated systems I.0416
- Allows shadow IT use without policy enforcement I.0417
- Allows transmission of business data via personal channels I.0418
- Lacks effective user behavior analytics capability I.0419
- Lacks RBAC enforcement on ePHI systems I.0420
- Lack modern authentication mechanisms to effectively manage privileged accounts I.0421
- Fails to participate in regular risk assessments I.0422
- Lacks sufficient review of policy exception requests I.0423
- Grants policy exceptions without adequate revocation process I.0424
- Extends policy exceptions beyond minimum requirement I.0425
- Approves repeated exceptions to endpoint protection policies I.0426
- Grants remote access without conditional controls I.0427
- Approved use of personal devices without device management or risk acceptance I.0428
- Fails to centrally track policy exceptions I.0429
- Fails to revoke policy exceptions in a timely manner I.0430
- Fails to escalate critical infrastructure policy violations I.0431
Cite this term
"Organization" (organization), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/subjects/organization
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.