Table of Contents
1. Purpose and Background
2. Procedures
a) Survey Tool Completion Procedures
3. Definitions
4. Related Links
5. Exceptions
REVISION HISTORY: May 6, 2022; November 17, 2020
1. Purpose and Background
The University of Virginia’s Information Security of University Technology Resources policy establishes the requirement for all departments to participate in the Information Security Risk Management Program. All departments within the University, College at Wise, Medical Center, and University-Associated Organizations (UAOs) are required to complete an annual information security risk assessment to evaluate the effectiveness of IT security controls, and thus identify and assess IT risks within their environments. The Information Security office is charged with assisting departments in the completion of this task by coordinating and distributing the required annual Information Security Risk Management tool, as outlined in the Information Security Risk Management Standard. The Information Security office establishes the annual timeline for its completion and acts as the central repository for the completed assessments.
This procedure applies to all departments or units; however, representatives of reporting departments comprised of multiple departmental units may choose to use the tool on behalf the department and its units rather than submitting multiple assessments for such departments.
2. Procedures
Information Security Risk Management Completion Procedures
Coming soon!!
The 2025 annual departmental Information Security Risk Management process will launch in the spring. An announcement will be made to the IT community. Please check back here at that time for instructions on completing the assessment.
3. Definitions
See the list of definitions for the Acceptable Use, Data Protection, Information Security, and Privacy & Confidentiality policies.
4. Related Links
- Information Security of University Technology Resources (IRM-004)
- Information Security Risk Management Standard
- Information Security - Risk Management Assessment Guidance
5. Exceptions
If you think you need to request an exception to these requirements, please refer to the Exceptions Process.