164.308(a)(1)(ii)(B) Risk Management (Required)
Administrative safeguard · Required
The requirement as we hold it
Risk Management (Required). Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. NIST recommends prioritized treatment plans, residual risk acceptance by leadership, and continuous monitoring tied to NIST SP 800-137.
The examiner asks
- Show me how each risk above acceptable was treated, and who accepted the residual risk.
- Where is the evidence that the chosen measures actually reduce the risk to a reasonable level?
Evidence to bring
- the risk treatment plan
- the residual-risk acceptance record
Source: 164.308(a)(1)(ii)(B) at eCFR. Our statement of the clause, not the instrument verbatim.