FFIEC IT Examination Handbook IS-IV.A.2(a): IV.A.2(a) Self-Assessments (Information Security)

What does IS-IV.A.2(a) require?

Organisational units perform periodic self-assessments at a frequency set by the assurance the risk management process requires, recognising their subjectivity and dependence on the assessor's knowledge and information, and management uses the results to strengthen the unit's information security and inform the overall test and evaluation process.