{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"compliance_regulatory","domain":["Governance, Policy & Oversight","Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-policy-absent","description":"Because documented, approved, and enforced security and privacy policies are missing and roles and duties are undefined, personnel operate without guidance on required controls and behaviours, so controls are applied inconsistently and accountability gaps leave violations undetected and unaddressed.","details":{"category":"compliance_regulatory","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"gov-policy-absent","taxonomies":["iso-27005-vulnerability","nist-privacy-risk"],"treatment":"mitigate"},"id":"risk:gov-policy-absent","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-policy-absent","sourceIds":["cobit-2019","coso-erm","coso-ic","gdpr","hipaa","iso-27001","nis2","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Missing or insufficient security and privacy policies","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:13f6aa7b3ed4b184eafd7da0757ae79318f89b1a9d20ab92bf53261aceb57e32","properties":{"rationale":"Establishing, approving, and maintaining the security policy suite directly remedies missing approved policies.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-14-f4f2c470.json","sourceId":"uc:UC-GOV-14","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:231c1989392043534ae70b45cf09c27b9dc697ce2c68633883243fdeea4b67e5","properties":{"rationale":"Defining and assigning security roles, responsibilities, and authorities directly remedies undefined roles and duties.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-06-f1eb1346.json","sourceId":"uc:UC-GOV-06","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:251c0e73768ca98fda93f31a33027edba793af39a97341f6031fd10d38f36631","properties":{"rationale":"Establishing communications-security and cryptography policies (encryption, MFA expectations) remedies missing policy for this domain.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-36-8eac71a2.json","sourceId":"uc:UC-GOV-36","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:478768bc2b6e32df7b2b4c0aa2727e33baa93896525bb45bd9f906eba92c730a","properties":{"rationale":"Establishing access-control, identity, and personnel-security policies remedies missing policies and undefined access duties.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-31-46e68199.json","sourceId":"uc:UC-GOV-31","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4a760fcc567e20c8fd330ef583b60f81d82c5562637becbcb37567687610101b","properties":{"rationale":"Establishing security-awareness and cyber-hygiene policies remedies missing policy for training content, cadence, and tracking.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-32-948a4756.json","sourceId":"uc:UC-GOV-32","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:64a5a678d76c853e57db846d787716bdefb4c70deed63f468466799e6d810fc1","properties":{"rationale":"Establishing asset-management, media-protection, and physical-protection policies remedies missing policies for this domain.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-30-6e914c26.json","sourceId":"uc:UC-GOV-30","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:81b0c91efc2a28b672c0564ac43522d22a352c500b9b0917b99e0f7685d7bb48","properties":{"rationale":"A DPO advising on and monitoring privacy-policy compliance addresses undefined roles and privacy-policy gaps.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-25-7960cafc.json","sourceId":"uc:UC-GOV-25","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:82d61a87f3f92111745e4f4f4e8a4bd7605a680afaaf7c0d2b54ac3b7a9d75c8","properties":{"rationale":"A management-approved, org-wide security program supplies the coordinated guidance whose absence leaves controls inconsistent.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-15-828b3eec.json","sourceId":"uc:UC-GOV-15","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8c3d5de4262f6ead11fef1e9374cc1e779b32feded749a47a40e6ef1c656b067","properties":{"rationale":"Establishing audit-logging, integrity, and continuous-monitoring policies remedies missing policy for this domain.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-33-50bafd1b.json","sourceId":"uc:UC-GOV-33","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b31cfc206efc91fc97e130dc732683be4fcbba6ff8e26ac0edd9f22c61b0ae4b","properties":{"rationale":"Establishing contingency/business-continuity policy and disruption-mitigation requirements remedies a missing resilience policy.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-34-3de22bbe.json","sourceId":"uc:UC-GOV-34","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d5c5c884c8a9c59593bd692124fe3444ee3063d0e197a5725ad73c73b8c695c3","properties":{"rationale":"Data-governance policies and chartered bodies with defined membership and responsibilities remedy missing data policies and undefined roles.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-20-4a468c1a.json","sourceId":"uc:UC-GOV-20","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e2cc926abdc7649873b87687a8659072360f3dd3f0f646b09684185fe553d3a8","properties":{"rationale":"Establishing secure acquisition, development, configuration, and maintenance policies remedies missing policies for this domain.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-29-7c321dee.json","sourceId":"uc:UC-GOV-29","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"}],"schemaVersion":1}