* Online resource from OCEG
In my last column, I introduced the “OCEG Foundation v1” (“Red Book”) available free (after a simple registration) from the Open Compliance & Ethics Group (OCEG). Today I want to tell you about the Red Book’s approach to risk management by showing you the structure of the document and drilling downwards to illustrate the kind of organization and an example of the detail-layer content.
The Red Book includes the following top-level sections:
C: Culture
O: Organization & Personnel
P: Process
T: Technology
It also includes extensive source references in the “Source Index” and the “OCEG Resource Index.”
Section “P” on Process is subdivided into these subsections:
PO: Plan & Organize
PR: Prevent, Protect & Prepare
D: Detect, Monitor & Evaluate
R: Respond & Improve
I: Information & Communication
Each of the subsections is further subdivided. For example, PR has the following subsections:
PR1: General Controls, Policies & Procedures
PR2: Code of Conduct
PR3: Training & Education
PR4: Workforce Management
PR5: Physical Infrastructure
PR6: Risk Sharing & Insurance
PR7: Preparedness & Practice
PR7 has two sections:
PR7.1: Design Preparedness Exercises
PR7.2: Conduct Preparedness Exercises
The first section has the following contents:
PR7.1: “Design preparedness exercises for each crisis category and for other high-impact risks.”
The descriptive text reads, “Preparedness exercises will provide hands-on training for the personnel who will be directly involved in the organization’s response to a crisis or other high-level risk. Management should select the appropriate exercise type for each crisis category and define a detailed plan. The exercise plan should clarify the role of each member of the crisis management team.”
The Core Practices listed for PR7.1 are (quoting directly):
101: For each crisis category and high impact risk, define a preparedness exercise plan including:
* scope of the exercise
* accountability for the preparedness exercise (ideally the same individuals accountable for the response, should the risk materialize)
* when to conduct the exercise
* where to conduct the exercise
* who is involved, including training of any personnel new to the crisis management team
* what will be done
* how the response will be evaluated
102: Select appropriate preparedness exercise type including:
* tabletop scenarios
* simulations
* activation exercise
The page includes the following in the “Additional Practices” section:
201: Use information from past crises to help design preparedness exercises.
The Red Book provides a high-level framework that can help organizations establish sound policies and procedures for core processes that profoundly influence information assurance. This text can provide the basis for months or in some cases years of work in bringing organizations to the level of best practices in management of personnel and resources. It’s that rarest of items, a free document of immense value.
It’s worth a look.
