164.308(a)(1)(i) Security Management Process (Standard)
Administrative safeguard · Standard
The requirement as we hold it
Security Management Process (Standard). Implement policies and procedures to prevent, detect, contain, and correct security violations. NIST recommends establishing an enterprise security governance program with defined roles and risk-based decision making.
The examiner asks
- Show me the policies and procedures that prevent, detect, contain and correct security violations, not only the incident form.
- Who owns the security management process, and where is that written down?
Evidence to bring
- the security management policy
- the named process owner
Source: 164.308(a)(1)(i) at eCFR. Our statement of the clause, not the instrument verbatim.