Insurance information security
IS-01Draft
Maintain a risk-based security program
How Leela would run itAnnual · at material risk changes and the company’s annual program review
Proposed stepsThe requirement
Identify assets and nonpublic information, document risk, assign accountable security leadership and obtain the required policy approval. Map each applicable Part 500 provision and exemption to an owner.
- Before this work
- Asset and control evidence sources Reviewed Part 500 scope and exemptions, with an approved risk method
- Applies
- Tell Leela about your company to see whether this applies.
- Status
- Setup needed
Tell Leela how you handle it today, or hand it over: see what’s next.
How Leela would run it · proposed steps
- LeelaAssemble the asset, data, risk and control inventory from connected records.Proposed step
- LeelaDraft the program review packet and highlight missing owners, evidence and policy approvals.Proposed step
- CISOThe CISO and accountable management confirm regulatory scope, approve the program and accept residual risks.Your team decides
What Leela keepsThe evidence this obligation leaves, as the work happens
Listed from the policy libraryContents
- 01Risk assessment, policy approval and scope registerControlled record with date, owner, source and review history
Evidence
Risk assessment, policy approval and scope register
Insurance information security §3.1
1
of 1 record
The steps are the library’s proposed workflow for this obligation: a description of the work, not a run. The records are its evidence in the library.