risk

Missing or insufficient security and privacy policies

Because documented, approved, and enforced security and privacy policies are missing and roles and duties are undefined, personnel operate without guidance on required controls and behaviours, so controls are applied inconsistently and accountability gaps leave violations undetected and unaddressed.

Record JSON · Open in map · Data retrieval guide

Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.

Attributes

category

compliance_regulatory

domain

• Governance, Policy & Oversight
• Data Protection & Privacy

taxonomy

• iso-27005-vulnerability
• nist-privacy-risk

inherent_rating

medium

Details

risk_id

gov-policy-absent

category

compliance_regulatory

likelihood

medium

impact

medium

inherent_rating

medium

treatment

mitigate

taxonomies

• iso-27005-vulnerability
• nist-privacy-risk

Source

No record-specific source URL is provided.

Connections

• UC-GOV-14 — Establish and maintain approved security policies and procedures mitigates Missing or insufficient security and privacy policies

  strength

  primary

  rationale

  Establishing, approving, and maintaining the security policy suite directly remedies missing approved policies.

• UC-GOV-06 — Define security roles, responsibilities, and authorities mitigates Missing or insufficient security and privacy policies

  strength

  primary

  rationale

  Defining and assigning security roles, responsibilities, and authorities directly remedies undefined roles and duties.

• UC-GOV-36 — Maintain communications security and cryptography policies mitigates Missing or insufficient security and privacy policies

  strength

  primary

  rationale

  Establishing communications-security and cryptography policies (encryption, MFA expectations) remedies missing policy for this domain.

• UC-GOV-31 — Maintain access control, identity, and personnel security policies mitigates Missing or insufficient security and privacy policies

  strength

  primary

  rationale

  Establishing access-control, identity, and personnel-security policies remedies missing policies and undefined access duties.

• UC-GOV-32 — Maintain security awareness and cyber-hygiene policies mitigates Missing or insufficient security and privacy policies

  strength

  primary

  rationale

  Establishing security-awareness and cyber-hygiene policies remedies missing policy for training content, cadence, and tracking.

• UC-GOV-30 — Maintain asset, media, and physical protection policies mitigates Missing or insufficient security and privacy policies

  strength

  primary

  rationale

  Establishing asset-management, media-protection, and physical-protection policies remedies missing policies for this domain.

• UC-GOV-25 — Operate a privacy program with accountable leadership mitigates Missing or insufficient security and privacy policies

  strength

  primary

  rationale

  A DPO advising on and monitoring privacy-policy compliance addresses undefined roles and privacy-policy gaps.

• UC-GOV-15 — Operate a management-approved information security program mitigates Missing or insufficient security and privacy policies

  strength

  primary

  rationale

  A management-approved, org-wide security program supplies the coordinated guidance whose absence leaves controls inconsistent.

• UC-GOV-33 — Maintain logging, monitoring, and system integrity policies mitigates Missing or insufficient security and privacy policies

  strength

  primary

  rationale

  Establishing audit-logging, integrity, and continuous-monitoring policies remedies missing policy for this domain.

• UC-GOV-34 — Maintain business continuity and contingency planning policy mitigates Missing or insufficient security and privacy policies

  strength

  primary

  rationale

  Establishing contingency/business-continuity policy and disruption-mitigation requirements remedies a missing resilience policy.

• UC-GOV-20 — Govern data as an asset with accountable oversight bodies mitigates Missing or insufficient security and privacy policies

  strength

  primary

  rationale

  Data-governance policies and chartered bodies with defined membership and responsibilities remedy missing data policies and undefined roles.

• UC-GOV-29 — Maintain secure acquisition, development, and maintenance policies mitigates Missing or insufficient security and privacy policies

  strength

  primary

  rationale

  Establishing secure acquisition, development, configuration, and maintenance policies remedies missing policies for this domain.