Create a Risk Recommendation

Introduction

Propose a change to a Risk Control across the entire Organization or for a specific Information System

• The user may make a Risk Recommendation on a Non-Standard Control for a System

• If making a Recommendation on a Standard control for a System, the Recommendation is made across all Systems with that Standard Control.

Step-By-Step Guide

1. Open the Details for an Information System

2. Mark a Sub Control as ‘Non-Standard’

3. Open the Recommendations section of the System Accordion

4. Click on the ‘Create Recommendation’ button

5. Choose the desired sub-control that is ‘Non-Standard’

6. Input an Observation and Recommendation

7. In the Recommendation section of the form, input a Change in Cost and a Change in Implementation

8. Run Monte Carlo analysis on the change by pressing the ‘Refresh Calculation’ button (should be highlighted at this point)

9. Press Submit on the Green Recommendation Details form

10. Press Submit on the main Observation form