Development of Security Risk Management Plan

⁠⁠⁠Security Risk Management Plan required for ARENA's ICT Environment (hardware and software)

A recent audit recommended that the entire ARENA ICT Platform be risk assessed, and that an SRMP be developed. We expect this work to commence in early February 2018 and conclude by the end of March 2018. ARENA operates a Unclassified-DLM environment.

We have a collection of risk management plans but no singular plan that governs the entire environment.

As a CIO, I need to understand the overall risk position for my ICT environment and be in a position to make decisions about mitigations and the acceptance of residual risks. I also need to be able to effectively report to the ICT Governance Committee on the controls required, and then implemented.

Analysis must span cyber security risks posed across all software and hardware in use at ARENA. Please note that ARENA is a small organisation, with less than 30 systems in use and a limited hardware footprint. It must also assess the current BYOD arrangements.