Risk Assessment Policy

1.0 Purpose

To empower CS department systems staff to perform periodic information security risk assessments (RAs) for the purpose of determining areas of vulnerability, and to initiate appropriate remediation.

2.0 Scope

Risk assessments can be conducted on any entity within SUNY Stony Brook CS department or any outsideentity that has signed a Third Party Agreement with SUNY Stony Brook CS department. RAs can be conducted on any information system, to include applications, servers, and networks, and any process or procedure by which these systems are administered and/or maintained.

3.0 Policy

The execution, development and implementation of remediation programs is the joint responsibility of CS department systems staff and the lab or group responsible for the systems area being assessed. Users are expected to cooperate fully with any RA being conducted on systems for which they are held accountable. Users are further expected to work with the CS department systems staff Risk Assessment Team in the development of a remediation plan.

4.0 Risk Assessment Process

For additional information, go to the Risk Assessment Process.

5.0 Enforcement

Any user found to have violated this policy may be subject to disciplinary action.

6.0 Definitions

Entity — Any business unit, department group, lab group, or third party, internal or external to SUNY Stony Brook CS department, responsible for maintaining SUNY Stony Brook CS department assets. User Any faculty, staff, visitor, visiting researcher, researcher or student who has access to a computer system or communication device at the CS department.

Risk — Those factors that could affect confidentiality, availability, and integrity of SUNY Stony Brook CS department's key information assets and systems. CS department systems staff is responsible for ensuring the integrity, confidentiality, and availability of critical information and computing assets, while minimizing the impact of security procedures and policies upon business productivity.