This document was retired in July 2021

Information Risk Management play a major role in the Police Service and in government agencies. All government departments and agencies must produce an Information Risk Management policy, as it is a fundamental aspect to Information Security Strategy as it has a huge impact on IA policies, standards and procedures. This must include:

• Information risk appetite

• Compliance with all legal and regulatory requirements

• IA governance framework

• Technical risk assessment against all ICT systems

This document serves as part of the Security Policy Framework (SPF) and supports the SPF mandatory requirements. 

The aim of this standard is to provide twenty Risk Management Requirements (RMRs), which government agencies must use as the basis for Information Risk Management Policy as well as supporting the intended readers list.

Intended readers are senior Information Assurance (IA) related government posts, Senior Information Risk Owners (SIROs), Departmental Security Officers (DSOs), Information Asset Owners (IAOs), Information Risk Managers (IRM), Security & Information Risk Advisors (SIRAs), Information Assurance Analysts.

For further enquiries, or if you'd like to provide feedback, please email or fax: 

Email: enquiries@cesg.gsi.gov.uk

Fax: (01242) 709193 (for UNCLASSIFIED FAXES ONLY)