Exploring the Maturity of Risk Management Process in Government: An Integrated ERM Model at the U.S. Department of Education
|
|
- Bartholomew Hampton
- 6 years ago
- Views:
Transcription
1 Exploring the Maturity of Risk Management Process in Government: An Integrated ERM Model at the U.S. Department of Education FEDERAL STUDENT AID ENTERPRISE RISK MANAGEMENT GROUP Cynthia Vitters
2 1. ERM in the Federal Government 2. Drivers for Risk Management in Government 3. Risk Management in Federal Agencies 4. FSA A Performance Based Organization 5. ERM Drivers at FSA 6. FSA s ERM Organization 7. FSA s ERM Program & Strategy 8. Current State of FSA ERM Program 9. Next Steps 10. Lessons Learned/Strategies to Consider Slide 1
3 Risk Management is not a new concept within federal government Need to integrate RM into strategic and decision making process Need to abandon outdated practices of managing risks in solos and stovepipes Few success stories, best practices, and a standard methodology in and across the federal sector Problems aren t unique to federal sector Slide 1
4 New Legislation & Regulations Requiring Better Management of Risk & Improved Controls American Recovery & Reinvestment Act Revised OMB Circular A-123 Federal Managers Financial Integrity Act (FMFIA) of 1982 Improper Payments Information Act of 2002 Federal Information Security Management Act (FISMA) of 2002 Slide 1
5 Health Risk - Food and Drug Administration, Center for Disease Control Security Risks - Department of Defense, Homeland Security Financial Risks Government National Mortgage Association, Securities and Exchange Commission Transportation and Safety Risks National Transportation Safety Board External Risks United States Postal Service Slide 1
6 An Integrated ERM Model at the U.S. Department of Education Office of Federal Student Aid
7 Federal Student Aid (FSA) is the largest program office in the U.S. Department of Education (ED) Administers programs that provide the nations largest source of student aid Responsible for administration and oversight of Federal financial aid programs (Pell Grants, Stafford Loans, PLUS Loans and Campus- Based programs) Has approximately 1,000 employees (augmented by 6,000 contractors) across the county at its headquarters in Washington, D.C, and at 10 regional offices throughout the U.S. Slide 2
8 Annual budget of approximately $690 million in FY 09 Administers approximately $100 billion of financial aid a year to college students Directly manages or oversees more than $575 billion in outstanding loans representing almost 95 million student loans to more than 30 million borrowers Is led by the Chief Operating Officer who is appointed by the Secretary of Education Slide 3
9 In 1998, Congress established Federal Student Aid as the first Performance-Based Organization (or PBO) in the Federal Government As a PBO, FSA operates under a congressional mandate to achieve concrete results while improving performance FSA is required to plan and report its operational and portfolio performance in administering the federal student financial assistance programs Slide 4
10 GAO High Risk List Designation Regulatory and reporting requirements (e.g., A-123, Improper Payments Act, President s Management Agenda, etc.) Increasing external threats (i.e., terrorism, pandemics, natural disasters, privacy and/or data security breaches, etc.) Desire to reduce Fraud, Waste, and Abuse More proactive approach to addressing risk Desire for improved risk management information across the organization Slide 5
11 Includes the Enterprise Risk Management Group (ERMG) and ERM Committee The ERMG was formally established in May 2006 and is headed by FSA s Chief Risk Officer (CRO) The CRO reports to the General Manager of Enterprise Performance Management Services (EPMS) with a dotted line to FSA s Chief Operating Officer FSA s ERM Committee is comprised of five executives: Chief Financial Officer, Chief Information Officer, Chief Business Operations Officer, Chief of Staff to the COO, and the CRO Slide 7
12 Chief Operating Officer Enterprise Performance Management Services Enterprise Risk Management Group Chief Risk Officer Risk Analysis & Reporting Division Internal Review Division Risk Analysis Data Analysis Internal Review Audit Liaison Slide 9
13 The Enterprise Risk Management Group (ERMG): Provides risk management oversight & guidance to Federal Student Aid Is responsible for driving enterprise risk strategy and implementing FSA s ERM Program Performs internal reviews and risk assessments Is organized into two main areas: Risk Analysis & Reporting Division Internal Review Division Slide 10
14 Vision To create the premier Enterprise Risk Management Program in the Federal government. One that provides for an integrated view of risk across the entire Federal Student Aid organization; aligns strategic risks with the organization s goals and objectives; ensures that risk issues are integrated into strategic decision making process; and manages risk to further the achievement of performance goals. Slide 11
15 Mission To enhance the ability of Federal Student Aid to identify, assess and manage risk across the enterprise Slide 12
16 Strategy Involves Top Down and Bottom Up Approaches ERM Program is multi-phased effort Implementing a COSO-Based ERM framework Current Timeline & Project Plan Contractor assistance Slide 13
17 Top Down Approach = High Level Risk Assessment (Targeted effort to identify & assess high-level, or strategic risks at Federal Student Aid) Bottom Up Approach = Detailed Risk Assessment Activities (Comprehensive effort to identify & assess risks across the organization s 28 business units) Slide 14
18 PHASE I Creation of ERM Organization Development of Strategic Plan for ERM Program Adoption of Common Risk Language and Categories High-Level Risk Assessment PHASE II Adoption of COSO-Based ERM Framework Development of Risk Assessment Methodology Implementation of Risk Technology Solutions Conduct of Initial COSO-Based Risk Activities Slide 15
19 PHASE III Completion of Initial COSO Framework activities Use of Risk Tracking System to develop ERM reports for executive management Development of Key Risk Indicators (KRI s), trending reports and other means of risk monitoring Methodology, planning and completion of remaining framework activities: Risk Response, Control, Information, Communication, and Monitoring Slide 16
20 COSO ERM Integrated Framework The COSO ERM CUBE Slide 17
21 FSA s ERM Framework is based on the ERM framework issued by Committee of Sponsoring Organizations of the Treadway Commission (COSO) in September 2004 The COSO ERM Integrated Framework consists of eight interrelated components and four objective categories applied across an entity s units The COSO Framework was developed with a focus on stockholder owned, for profit institutions FSA is conducting activities based on the COSO framework, but utilizing additional practices, measures and approaches to maximize value in a government, PBO setting FSA s ERM Framework also includes consideration of concepts and/or guidance from other Risk Management Frameworks (e.g., ISO and AZ/NZ 4360) Slide 18
22 Creation and staffing of ERMG Organization Development of ERM Strategy and Program Adoption of COSO-Based ERM Framework Development of risk tools & resources (e.g., common risk vocabulary, categories and definitions) Development & implementation of Risk Tracking System (RTS) Conduct of High-Level (Strategic) Risk Assessments Slide 19
23 Risk Activities complete in over half of FSA s business units Over 600 business unit risks inventoried and assessed Associated risk information entered into Risk Tracking System Development of Enterprise and Strategic Level Risk Reporting Slide 20
24 FSA (Source: U.S. Postal Office) Slide 21
25 Documentation of Business Unit objectives Facilitated Risk Discussions Risk identification and categorization Cross-walk risks with A-123 and project risks Risk Ratings (Significance & Likelihood) and Aggregate Risk Scoring Heat Map Summary Report Slide 22
26 Risk Identification, Categorization & Scoring Slide 23
27 Heat Map Aggregate Risk Scores Critical (>10) - Likelihood High (9-10) - Medium ( ) Moderate (5-6.5) - Low (1-4.5) Significance Slide 24
28 ERM fully integrated into strategic planning and decision-making process All major risk types for FSA incorporated into ERM Program (i.e., business unit, project, program, and portfolio risks) Advanced risk monitoring, modeling, and trending capabilities Executive-level and comprehensive risk management organization Key risk functions fall under ERM umbrella Slide 25
29 Implementing ERM is a cultural change that takes time, resources and executive level support Assign ERM responsibility to a dedicated risk executive with direct access to the highest levels in your organization Institutional/organizational knowledge can be invaluable A separate risk organization with adequate risk resources will significantly increase chances for successfully implementing ERM Slide 26
30 Most ERM efforts, even mature ones, are works-in-process. Some flexibility is key to successfully implementing your ERM Program. ERM is a dynamic process that continues to evolve The real value of ERM is realized when it becomes a regular part of everyday business. Slide 27
31 Thank You We appreciate your feedback and comments. Cynthia Vitters (202) U.S. Department of Education Federal Student Aid Enterprise Risk Management Group
Compliance Program Design Lessons learned from a COSO framework
Compliance Program Design Lessons learned from a COSO framework Joseph Walsh President, Legacy Detroit Medical Center Christina DuVall Corporate Compliance Director CMS Overview Electric Gas Combination
More informationWhy you should adopt the NIST Cybersecurity Framework
Why you should adopt the NIST Cybersecurity Framework It s important to note that the Framework casts the discussion of cybersecurity in the vocabulary of risk management Stating it in terms Executive
More informationIT-CNP, Inc. Capability Statement
Securing America s Infrastructure Security Compliant IT Operations Hosting Cyber Security Information FISMA Cloud Management Hosting Security Compliant IT Logistics Hosting 1 IT-CNP, Inc. is a Government
More informationInspector General. Report on the Peace Corps Information Security Program. Peace Corps Office of. Background FISCAL YEAR 2017
Peace Corps Office of Inspector General Our Mission: Through audits, evaluations, and investigations, the Office of Inspector General provides independent oversight of agency programs and operations in
More informationMNsure Privacy Program Strategic Plan FY
MNsure Privacy Program Strategic Plan FY 2018-2019 July 2018 Table of Contents Introduction... 3 Privacy Program Mission... 4 Strategic Goals of the Privacy Office... 4 Short-Term Goals... 4 Long-Term
More informationMANUAL OF UNIVERSITY POLICIES PROCEDURES AND GUIDELINES. Applies to: faculty staff students student employees visitors contractors
Page 1 of 6 Applies to: faculty staff students student employees visitors contractors Effective Date of This Revision: June 1, 2018 Contact for More Information: HIPAA Privacy Officer Board Policy Administrative
More informationBusiness Continuity An Integral Part of Risk Management At Constellation Energy
Business Continuity An Integral Part of Risk Management At Constellation Energy World Disaster Management Conference Toronto, Canada June 19, 2006 Robert W. Cornelius Director Business Continuity Operating
More informationVirginia State University Policies Manual. Title: Information Security Program Policy: 6110
Purpose Virginia State University (VSU) uses information to perform the business services and functions necessary to fulfill its mission. VSU information is contained in many different mediums including
More informationInformation Systems Security Requirements for Federal GIS Initiatives
Requirements for Federal GIS Initiatives Alan R. Butler, CDP Senior Project Manager Penobscot Bay Media, LLC 32 Washington Street, Suite 230 Camden, ME 04841 1 Federal GIS "We are at risk," advises the
More informationREVIEW OF MANAGEMENT AND OVERSIGHT OF THE INTEGRATED BUSINESS MANAGEMENT SYSTEM (IBMS) January 16, 2009
APPENDIX 1 REVIEW OF MANAGEMENT AND OVERSIGHT OF THE INTEGRATED BUSINESS MANAGEMENT SYSTEM (IBMS) January 16, 2009 Auditor General s Office Jeffrey Griffiths, C.A., C.F.E. Auditor General City of Toronto
More informationSingapore Quick Guide to the COSO. Enterprise Risk Management and Internal Control Frameworks Edition
Singapore Quick Guide to the COSO Enterprise Risk Management and Internal Control Frameworks 2016 Edition The Protiviti-SAC COSO Academy The Protiviti-SAC COSO Academy in Singapore was formed by global
More informationUNIVERSITY OF MASSACHUSETTS AMHERST INFORMATION SECURITY POLICY September 20, 2017
UNIVERSITY OF MASSACHUSETTS AMHERST INFORMATION SECURITY POLICY September 20, 2017 I. Introduction Institutional information, research data, and information technology (IT) resources are critical assets
More information01.0 Policy Responsibilities and Oversight
Number 1.0 Policy Owner Information Security and Technology Policy Policy Responsibility & Oversight Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 1. Policy Responsibilities
More information300 Riverview Plaza Odysseus Marcopolus, Chief Operating Officer Trenton, NJ POLICY NO: SUPERSEDES: N/A VERSION: 1.0
P.O. Box 212 Philip D. Murphy, Governor 300 Riverview Plaza Odysseus Marcopolus, Chief Operating Officer Trenton, NJ 08625-0212 www.tech.nj.gov STATE OF NEW JERSEY TECHNOLOGY CIRCULAR Enterprise Information
More informationCybersecurity Presidential Policy Directive Frequently Asked Questions. kpmg.com
Cybersecurity Presidential Policy Directive Frequently Asked Questions kpmg.com Introduction On February 12, 2013, the White House released the official version of the Presidential Policy Directive regarding
More informationCISM Certified Information Security Manager
CISM Certified Information Security Manager Firebrand Custom Designed Courseware Logistics Start Time Breaks End Time Fire escapes Instructor Introductions Introduction to Information Security Management
More informationREPORT 2015/149 INTERNAL AUDIT DIVISION
INTERNAL AUDIT DIVISION REPORT 2015/149 Audit of the information and communications technology operations in the Investment Management Division of the United Nations Joint Staff Pension Fund Overall results
More informationEnterprise Risk Management (ERM) and Cybersecurity. Na9onal Science Founda9on March 14, 2018
Enterprise Risk Management (ERM) and Cybersecurity Na9onal Science Founda9on March 14, 2018 Agenda Guiding Principles for Implementing ERM at NSF (Based on COSO) NSF s ERM Framework ERM Cybersecurity Risk
More informationStephanie Zierten Associate Counsel Federal Reserve Bank of Boston
Stephanie Zierten Associate Counsel Federal Reserve Bank of Boston Cybersecurity Landscape Major Data Breaches (e.g., OPM, IRS) Data Breach Notification Laws Directors Derivative Suits Federal Legislation
More informationDHS Overview of Sustainability and Environmental Programs. Dr. Teresa R. Pohlman Executive Director, Sustainability and Environmental Programs
DHS Overview of Sustainability and Environmental Programs Dr. Teresa R. Pohlman Executive Director, Sustainability and Environmental Programs DHS Mission DHS Organization Getting to Know DHS Mission: Secure
More informationKansas City s Metropolitan Emergency Information System (MEIS)
Information- Sharing Interagency Cooperation Resources Management Law Enforcement Fire Emergency Medical Services Public Health Private Sector Kansas City s Metropolitan Emergency Information System (MEIS)
More informationNational Policy and Guiding Principles
National Policy and Guiding Principles National Policy, Principles, and Organization This section describes the national policy that shapes the National Strategy to Secure Cyberspace and the basic framework
More informationCOSO Enterprise Risk Management
COSO Enterprise Risk Management COSO Enterprise Risk Management Establishing Effective Governance, Risk, and Compliance Processes Second Edition ROBERT R. MOELLER John Wiley & Sons, Inc. Copyright # 2007,
More informationCybersecurity & Privacy Enhancements
Business, Industry and Government Cybersecurity & Privacy Enhancements John Lainhart, Director, Grant Thornton The National Institute of Standards and Technology (NIST) is in the process of updating their
More informationGlobal Statement of Business Continuity
Business Continuity Management Version 1.0-2017 Date January 25, 2017 Status Author Business Continuity Management (BCM) Table of Contents 1. Credit Suisse Business Continuity Statement 3 2. BCM Program
More informationRethinking Information Security Risk Management CRM002
Rethinking Information Security Risk Management CRM002 Speakers: Tanya Scott, Senior Manager, Information Risk Management, Lending Club Learning Objectives At the end of this session, you will: Design
More informationCybersecurity in Higher Ed
Cybersecurity in Higher Ed 1 Overview Universities are a treasure trove of information. With cyber threats constantly changing, there is a need to be vigilant in protecting information related to students,
More informationUNIVERSITY OF MASSACHUSETTS AMHERST INFORMATION SECURITY POLICY October 25, 2017
UNIVERSITY OF MASSACHUSETTS AMHERST INFORMATION SECURITY POLICY October 25, 2017 I. Introduction Institutional information, research data, and information technology (IT) resources are critical assets
More informationFive-Year Strategic Plan
Five-Year Strategic Plan 2016 2020 Contents A Message from the ERIS Board... 3 Introduction and Background... 4 Five-Year Plan Goal Areas... 7 Goal Area 1: State Environmental Agency Research Needs and
More informationMapping to the National Broadband Plan
The National Telecommunications and Information Administration Mapping to the National Broadband Plan 37 th Annual PURC Conference Smart Technology vs. Smart Policy February 3, 2010 1 About NTIA The National
More informationSession 5: Business Continuity, with Business Impact Analysis
Session 5: Business Continuity, with Business Impact Analysis By: Tuncay Efendioglu, Acting Director Internal Oversight Division, WIPO Pierre-François Gadpaille, Audit Specialist (Information Systems),
More informationSolutions Technology, Inc. (STI) Corporate Capability Brief
Solutions Technology, Inc. (STI) Corporate Capability Brief STI CORPORATE OVERVIEW Located in the metropolitan area of Washington, District of Columbia (D.C.), Solutions Technology Inc. (STI), women owned
More informationINFORMATION TECHNOLOGY CYBERSECURITY CLOUD COMPUTING
INFORMATION TECHNOLOGY CYBERSECURITY CLOUD COMPUTING PRESENTED TO HOUSE APPROPRIATIONS COMMITTEE LEGISLATIVE BUDGET BOARD STAFF APRIL 2018 Statement of Interim Charge Monitor the ongoing implementation
More informationStandard for Security of Information Technology Resources
MARSHALL UNIVERSITY INFORMATION TECHNOLOGY COUNCIL Standard ITP-44 Standard for Security of Information Technology Resources 1 General Information: Marshall University expects all individuals using information
More information354 & Index Board of Directors Responsibilities Audit Committee and Risk Committee Coordination, 244 Audit Committee Functions and Responsibilities, 2
Index Accounts Payable Process Review Procedures Assessments, 191 Actions to Resolve Risks COSO ERM Control Activities, 97 Activity Management COSO ERM Control Activities, 81 AICPA SAS No. 1 Internal Controls
More informationGAO INFORMATION SECURITY. Veterans Affairs Needs to Address Long-Standing Weaknesses
GAO United States Government Accountability Office Testimony Before the Subcommittee on Oversight and Investigations, Committee on Veterans Affairs, House of Representatives For Release on Delivery Expected
More informationFiscal Year 2013 Federal Information Security Management Act Report
U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Fiscal Year 2013 Federal Information Security Management Act Report Status of EPA s Computer Security Program Report. 14-P-0033 vember 26,
More informationExhibit to Agenda Item #3
Exhibit to Agenda Item #3 Special SMUD Board of Directors Meeting Tuesday, scheduled to begin at 5:30 p.m. Customer Service Center, Rubicon Room Powering forward. Together. Physical Security Audit observations
More informationBUSINESS CONTINUITY MANAGEMENT PROGRAM OVERVIEW
BUSINESS CONTINUITY MANAGEMENT PROGRAM OVERVIEW EXECUTIVE SUMMARY CenturyLink is committed to ensuring business resiliency and survivability during an incident or business disruption. Our Corporate Business
More informationPutting It All Together:
Putting It All Together: The Interplay of Privacy & Security Regina Verde, MS, MBA, CHC Chief Corporate Compliance & Privacy Officer University of Virginia Health System 2017 ISPRO Conference October 24,
More informationLegal and Regulatory Developments for Privacy and Security
Legal and Regulatory Developments for Privacy and Security Rodney Petersen Government Relations Officer and Director of EDUCAUSE Cybersecurity Initiative Overview Context for Federal Policy Policy Directions
More informationJSC THE JUSTICE & SAFETY CENTER. Snapshot 2014
JSC THE JUSTICE & SAFETY CENTER Snapshot 2014 The Justice & Safety Center (JSC) is comprised of a team of faculty and staff professionals at Eastern Kentucky University (EKU) dedicated to strengthening
More informationCandidate Profile for the Position of Vice President, Education and Certification
Candidate Profile for the Position of Vice President, Education and Certification * * * * This profile provides information about the National Automatic Merchandising Association and the position requirements
More informationNIST Special Publication
NIST Special Publication 800-53 Practical Application of the Minimum Baseline Security Controls Graydon S. McKee IV CISSP, GSEC A Framework for All Seasons With the finalization of Federal Information
More informationNERC Staff Organization Chart Budget 2017
NERC Staff Organization Chart Budget 2017 President and CEO Administrative Associate Director to the Office of the CEO Senior Vice President and Chief Reliability Senior Vice President, General Counsel
More informationPolicies and Procedures Date: February 28, 2012
No. 5200 Rev.: 1 Policies and Procedures Date: February 28, 2012 Subject: Information Technology Security Program 1. Purpose... 1 2. Policy... 1 2.1. Program Elements... 1 2.2. Applicability and Scope...
More informationWritten Statement of. Timothy J. Scott Chief Security Officer The Dow Chemical Company
Written Statement of Timothy J. Scott Chief Security Officer The Dow Chemical Company Representing The Dow Chemical Company and the American Chemistry Council To the United States Senate Committee on Homeland
More informationCyberUSA Government Cyber Opportunities for your Region: The Federal Agenda - Federal, Grants & Resources Available to Support Community Cyber
CyberUSA Government Cyber Opportunities for your Region: The Federal Agenda - Federal, Grants & Resources Available to Support Community Cyber Initiatives 30 January 2018 1 Agenda Federal Landscape Cybersecurity
More informationCOSO Enterprise Risk Management
COSO Enterprise Risk Management Establishing Effective Governance, Risk, and Compliance Processes Second Edition ROBERT R. MOELLER WILEY John Wiley & Sons, Inc. Contents Preface xi Chapter 1: Introduction:
More informationAnnual Report for the Utility Savings Initiative
Report to the North Carolina General Assembly Annual Report for the Utility Savings Initiative July 1, 2016 June 30, 2017 NORTH CAROLINA DEPARTMENT OF ENVIRONMENTAL QUALITY http://portal.ncdenr.org Page
More informationVII. GUIDE TO AGENCY PROGRAMS
VII. GUIDE TO AGENCY PROGRAMS Executive Offices and Centers David L. Lakey, M.D., Commissioner Kirk Cole, Associate Commissioner Luanne Southern, Deputy Commissioner FTEs: 71.1 Commissioner FTEs: 1.5 The
More informationNERC Staff Organization Chart Budget 2017
NERC Staff Organization Chart Budget 2017 President and CEO Administrative Associate Director to the Office of the CEO Senior Vice President and Chief Reliability Senior Vice President, General Counsel
More informationHomeland Security Institute. Annual Report. pursuant to. Homeland Security Act of 2002
Homeland Security Institute Annual Report pursuant to Homeland Security Act of 2002 July 1, 2005 Homeland Security Institute ANNUAL REPORT Introduction Established in April 2004, the Homeland Security
More informationReviewed by ADM(RS) in accordance with the Access to Information Act. Information UNCLASSIFIED.
Assistant Deputy Minister (Review Services) Reviewed by in accordance with the Access to Information Act. Information UNCLASSIFIED. Security Audits: Management Action Plan Follow-up December 2015 1850-3-003
More information10/18/2016. Preparing Your Organization for a HHS OIG Information Security Audit. Models for Risk Assessment
Preparing Your Organization for a HHS OIG Information Security Audit David Holtzman, JD, CIPP/G CynergisTek, Inc. Brian C. Johnson, CPA, CISA HHS OIG Section 1: Models for Risk Assessment Section 2: Preparing
More informationInformation Technology General Control Review
Information Technology General Control Review David L. Shissler, Senior IT Auditor, CPA, CISA, CISSP Office of Internal Audit and Risk Assessment September 15, 2016 Background Presenter Senior IT Auditor
More informationACR 2 Solutions Compliance Tools
ACR 2 Solutions Compliance Tools What s all the noise about the Cyber Security Framework? The Cyber Security Framework Airs Conference May 2017 About ACR 2 Solutions your NIST experts ACR2 is a developer
More informationEMERGENCY MANAGEMENT
CSU The California State University Office of Audit and Advisory Services EMERGENCY MANAGEMENT California State University, Dominguez Hills Audit Report 16-43 August 30, 2016 EXECUTIVE SUMMARY OBJECTIVE
More informationResolution adopted by the General Assembly. [on the report of the Fifth Committee (A/61/592/Add.4)]
United Nations General Assembly Distr.: General 2 May 2007 Sixty-first session Agenda item 117 Resolution adopted by the General Assembly [on the report of the Fifth Committee (A/61/592/Add.4)] 61/263.
More informationAUDIT UNITED NATIONS VOLUNTEERS PROGRAMME INFORMATION AND COMMUNICATION TECHNOLOGY. Report No Issue Date: 8 January 2014
UNITED NATIONS DEVELOPMENT PROGRAMME AUDIT OF UNITED NATIONS VOLUNTEERS PROGRAMME INFORMATION AND COMMUNICATION TECHNOLOGY Report No. 1173 Issue Date: 8 January 2014 Table of Contents Executive Summary
More informationFISMAand the Risk Management Framework
FISMAand the Risk Management Framework The New Practice of Federal Cyber Security Stephen D. Gantz Daniel R. Phi I pott Darren Windham, Technical Editor ^jm* ELSEVIER AMSTERDAM BOSTON HEIDELBERG LONDON
More informationCybersecurity and the Board of Directors
Cybersecurity and the Board of Directors Key Findings from BITS/FSR Meetings OVERVIEW Board directors are increasingly required to engage in cybersecurity risk management yet some may need better education
More informationNERC Staff Organization Chart Budget 2019
NERC Staff Organization Chart Budget 2019 President and CEO Associate Director to the Office of the CEO Senior Vice President and Chief Reliability Senior Vice President, General Counsel and Corporate
More informationDavid Missouri VP- Governance ISACA
David Missouri VP- Governance ISACA Present-Senior Agency Information Security Officer (SAISO) @GA DJJ 2012-2016 Information System Security Officer (ISSO) @ US DOL WHD 2011-2012 Network Administrator
More informationProgram Review for Information Security Management Assistance. Keith Watson, CISSP- ISSAP, CISA IA Research Engineer, CERIAS
Program Review for Information Security Management Assistance Keith Watson, CISSP- ISSAP, CISA IA Research Engineer, CERIAS Disclaimer and Purpose PRISMA, FISMA, and NIST, oh my! PRISMA versus an Assessment
More informationSTRENGTHENING THE CYBERSECURITY OF FEDERAL NETWORKS AND CRITICAL INFRASTRUCTURE
STRENGTHENING THE CYBERSECURITY OF FEDERAL NETWORKS AND CRITICAL INFRASTRUCTURE By the authority vested in me as President by the Constitution and the laws of the United States of America, it is hereby
More informationGEORGIA CYBERSECURITY WORKFORCE ACADEMY. NASCIO 2018 State IT Recognition Awards
GEORGIA CYBERSECURITY WORKFORCE ACADEMY NASCIO 2018 State IT Recognition Awards Title: Georgia Cybersecurity Workforce Academy Category: Cybersecurity State: Georgia Contact: Stanton Gatewood Stan.Gatewood@gta.ga.gov
More informationManagement s Response to the Auditor General s Review of Management and Oversight of the Integrated Business Management System (IBMS)
APPENDI 2 ommendation () () 1. The City Manager in consultation with the Chief Information Officer give consideration to the establishment of an IBMS governance model which provides for senior management
More informationGlobal Security Consulting Services, compliancy and risk asessment services
Global Security Consulting Services, compliancy and risk asessment services Introduced by Nadine Dereza Presented by Suheil Shahryar Director of Global Security Consulting Today s Business Environment
More informationThe HITRUST CSF. A Revolutionary Way to Protect Electronic Health Information
The HITRUST CSF A Revolutionary Way to Protect Electronic Health Information June 2015 The HITRUST CSF 2 Organizations in the healthcare industry are under immense pressure to improve quality, reduce complexity,
More informationNERC Staff Organization Chart Budget 2018
NERC Staff Organization Chart Budget 2018 President and CEO Associate Director to the Office of the CEO Senior Vice President and Chief Reliability Senior Vice President, General Counsel and Corporate
More informationStatement of Organization, Functions, and Delegations of Authority: Office of the
This document is scheduled to be published in the Federal Register on 07/27/2016 and available online at http://federalregister.gov/a/2016-17737, and on FDsys.gov 4184-40P DEPARTMENT OF HEALTH AND HUMAN
More informationISACA GEEK WEEK SECURITY MANAGEMENT TO ENTERPRISE RISK MANAGEMENT USING THE ISO FRAMEWORK AUGUST 19, 2015
ISACA GEEK WEEK SECURITY MANAGEMENT TO ENTERPRISE RISK MANAGEMENT USING THE ISO 27001 FRAMEWORK AUGUST 19, 2015 Agenda Coalfire Overview Threat Landscape What is ISO Why ISO ISO Cycle Q&A 2 Presenters
More informationFederal Government. Each fiscal year the Federal Government is challenged CATEGORY MANAGEMENT IN THE WHAT IS CATEGORY MANAGEMENT?
CATEGORY MANAGEMENT IN THE Federal Government Each fiscal year the Federal Government is challenged to accomplish strategic goals while reducing spend and operating more efficiently. In 2014, the Federal
More informationEnergy Assurance Plans
Energy Assurance Plans funded through the American Reinvestment and Recovery Act (ARRA) - Stimulus $$ to help create jobs to enhance energy reliability and facilitate recovery from disruptions to the energy
More informationB. To ensure compliance with federal and state laws, rules, and regulations, including, but not limited to:
Executive Policy, EP 2.215 Institutional Data Governance Page 1 of 14 Executive Policy Chapter 2, Administration Executive Policy EP 2.215, Institutional Data Governance Effective Date: xxxx 2017 Prior
More informationNERC Staff Organization Chart Budget 2019
NERC Staff Organization Chart Budget 2019 President and CEO Associate Director to the Office of the CEO Senior Vice President and Chief Reliability Officer Senior Vice President, General Counsel and Corporate
More informationPresenter: Ian Musweu FCCA, FZICA, CRA. Head of Risk and Assurance Professional Insurance
Presenter: Ian Musweu FCCA, FZICA, CRA Head of Risk and Assurance Professional Insurance Contents: Introduction; Overview of the two major frameworks Frameworks side by side Similarities and differences
More informationGAO INFORMATION SHARING ENVIRONMENT
GAO United States Government Accountability Office Report to Congressional Requesters June 2008 INFORMATION SHARING ENVIRONMENT Definition of the Results to Be Achieved in Improving Terrorism-Related Information
More informationThe Texas A&M University System. Internal Audit Department. Fiscal Year 2014 Audit Plan
Introduction The purpose of the Audit Plan is to outline audits and other activities the System Internal Audit Department will conduct during fiscal year 2014. The plan is developed to satisfy responsibilities
More informationLAMOND W. KEARSE Metropolitan Transportation Authority Chief Compliance Officer
LAMOND W. KEARSE Metropolitan Transportation Authority Chief Compliance Officer BUILDING AN EFFECTIVE GOVERNANCE RISK AND COMPLIANCE PROGRAM You Can t Have One without the Other METROPOLITAN TRANSPORTATION
More informationFOLLOW-UP REPORT Industrial Control Systems Audit
FOLLOW-UP REPORT Industrial Control Systems Audit February 2017 Office of the Auditor Audit Services Division City and County of Denver Timothy M. O Brien, CPA The Auditor of the City and County of Denver
More informationPD 7: Homeland Security Presidential Directive 7: Critical Infrastructure Identification, Prioritization, and Protection
PD 7: Homeland Security Presidential Directive 7: Critical Infrastructure Identification, Prioritization, and Protection December 17, 2003 SUBJECT: Critical Infrastructure Identification, Prioritization,
More informationBPS Suite and the OCEG Capability Model. Mapping the OCEG Capability Model to the BPS Suite s product capability.
BPS Suite and the OCEG Capability Model Mapping the OCEG Capability Model to the BPS Suite s product capability. BPS Contents Introduction... 2 GRC activities... 2 BPS and the Capability Model for GRC...
More informationDefense Security Service. Strategic Plan Addendum, April Our Agency, Our Mission, Our Responsibility
Strategic Plan 2020 Addendum, April 2017 Our Agency, Our Mission, Our Responsibility [2] DSS Strategic Plan Addendum 2020 Addendum The DSS Strategic Plan 2020 is designed to support the agency s continuous
More informationREPORT 2015/186 INTERNAL AUDIT DIVISION
INTERNAL AUDIT DIVISION REPORT 2015/186 Audit of information and communications technology operations in the Secretariat of the United Nations Joint Staff Pension Fund Overall results relating to the effective
More informationCybersecurity Risk Management:
Cybersecurity Risk Management: Building a Culture of Responsibility G7 ICT and Industry Multistakeholder Conference September 25 2017 Adam Sedgewick asedgewick@doc.gov Cybersecurity in the Department of
More informationData Governance Central to Data Management Success
Data Governance Central to Data Success International Anne Marie Smith, Ph.D. DAMA International DMBOK Editorial Review Board Primary Contributor EWSolutions, Inc Principal Consultant and Director of Education
More informationInformation Collection Request: The Department of Homeland. Security, Stakeholder Engagement and Cyber Infrastructure
This document is scheduled to be published in the Federal Register on 07/18/2017 and available online at https://federalregister.gov/d/2017-15068, and on FDsys.gov 9110-9P P DEPARTMENT OF HOMELAND SECURITY
More informationEmergency Management BC Update
Emergency Management BC Update Provincial Emergency Program Emergency Management BC Update on Initiatives Union of BC Municipalities 2016 Conference September 29, 2016 Agenda Emergency Management BC Overview
More informationSubject: University Information Technology Resource Security Policy: OUTDATED
Policy 1-18 Rev. 2 Date: September 7, 2006 Back to Index Subject: University Information Technology Resource Security Policy: I. PURPOSE II. University Information Technology Resources are at risk from
More informationSystem Chief Business Officer - B. J. Crain The Texas A&M University System Position Description--January 13, 2010
System Chief Business Officer - B. J. Crain Position Description--January 13, 2010 Dual reporting to the Chancellor and President of Texas A&M University with consideration to an executive oversight committee*
More informationASSEMBLY, No STATE OF NEW JERSEY. 217th LEGISLATURE INTRODUCED FEBRUARY 4, 2016
ASSEMBLY, No. STATE OF NEW JERSEY th LEGISLATURE INTRODUCED FEBRUARY, 0 Sponsored by: Assemblywoman VALERIE VAINIERI HUTTLE District (Bergen) Assemblyman DANIEL R. BENSON District (Mercer and Middlesex)
More informationRisk Assessment: Key to a successful risk management program
Risk Assessment: Key to a successful risk management program Sixteenth National HIPAA Summit Timothy H Rearick, MBA, PMP August 22, 2008 Learning Objectives Define risk assessment Why complete a risk assessment
More informationOverview of NIPP 2013: Partnering for Critical Infrastructure Security and Resilience October 2013
Overview of NIPP 2013: Partnering for Critical Infrastructure Security and Resilience October 2013 PPD-21: CI Security and Resilience On February 12, 2013, President Obama signed Presidential Policy Directive
More informationDecember 10, Statement of the Securities Industry and Financial Markets Association. Senate Committee on Banking, Housing, and Urban Development
December 10, 2014 Statement of the Securities Industry and Financial Markets Association Senate Committee on Banking, Housing, and Urban Development Hearing Entitled Cybersecurity: Enhancing Coordination
More informationREPORT Bill Bradbury, Secretary of State Cathy Pollino, Director, Audits Division
Secretary of State Report No. 2003-20 June 3, 2003 AUDIT Department of Administrative Services Information Resources Management Division Follow Up REPORT Bill Bradbury, Secretary of State Cathy Pollino,
More informationREPORT 2015/010 INTERNAL AUDIT DIVISION
INTERNAL AUDIT DIVISION REPORT 2015/010 Audit of information and communications technology strategic planning, governance and management in the Investment Management Division of the United Nations Joint
More information79th OREGON LEGISLATIVE ASSEMBLY Regular Session. Senate Bill 90
th OREGON LEGISLATIVE ASSEMBLY-- Regular Session Senate Bill 0 Printed pursuant to Senate Interim Rule. by order of the President of the Senate in conformance with presession filing rules, indicating neither
More informationData Protection. Practical Strategies for Getting it Right. Jamie Ross Data Security Day June 8, 2016
Data Protection Practical Strategies for Getting it Right Jamie Ross Data Security Day June 8, 2016 Agenda 1) Data protection key drivers and the need for an integrated approach 2) Common challenges data
More information