It is the policy of Fay Servicing, LLC (“Fay”) to define the risk management requirements to protect the confidentiality, integrity and availability of its Information Resources. To accomplish this task, a formal
Information Security Risk Management Program has been established as a component of the
Organization's overall risk management policy and is an integral part of Fay’s Information Security
Program to ensure that Fay is operating with an acceptable level of risk. The Information Security Risk
Management Program is described in this Policy.
2. Overview
Risk Management is the continuous process which allows Fay’s business owners to balance the operational and economic costs of protective measures while achieving gains in mission capability, …show more content…
Risk remediation efforts are tracked in Fay’s Information Security Risk Register.
A low and medium risk may be accepted by the Chief Information Officer and/or CISO with appropriate documentation (via Fay Risk Acceptance Form) and periodic review. High and/or critical risks will require acceptance from the CEO. Critical risk should also be submitted to the Board for acceptance. If a previously accepted risk is realized in a real incident, the risk analysis and management processes are repeated to include the new information, and re-addressed with greater sensitivity and urgency based on the nature and extent of the incident.
3. Scope
Information Security Risk Management covers all of Fay’s Information Resources, whether managed or hosted internally or externally. This policy covers all data and information systems owned, operated, leased, or in the care of Fay Servicing as well as those who utilize them.
4. …show more content…
 Security Controls - Mechanisms, either technical or procedural, which are designed to reduce risk.
5. Policy Owner
Roles & Responsibilities
The IT Chief of Staff Office and the IT Compliance and Risk Management Group are responsible for development of a Risk Management Program, for conducting a periodic risk analysis of Fay systems
(with input from the CISO), and for oversight of this policy.
The CISO is responsible for assisting the IT Chief of Staff Office in the performance of the risk analysis and for implementing security measures and safeguards identified to mitigate risk.
The Chief Information Officer (or designee) is responsible for setting and defining the acceptable levels of risk for Fay systems.
IT Management, System Owners, Database Administrators and Data Owners are responsible for working with the IT Compliance and Risk Management Group to implement the Information Security
Risk Management Program, including remediation of identified risks in a timely