Policy Advisory  Information Security Risk Management Standard

Date:	01/01/2025
Organization:	Cybersecurity and Enterprise Risk Management
Referenced Sources:	MGL Chapter 7D, Section 2

The Information Security Risk Management Standard reinforces the Commonwealth’s commitment to an risk management strategy and outlines the controls necessary to safeguard the Commonwealth’s information assets and reduce risks.

Purpose

The purpose of this standard is to define the key elements of the Commonwealth’s information security risk assessment model to enable consistent identification, evaluation, response, mitigation and monitoring of risks facing IT processes.