Basic Principles of The Risk IT Framework

There are two basic principles of the Risk IT Framework:

Effective enterprise governance of IT risk
o Always connects to business objectives
o Aligns the management of IT-related business risk with overall enterprise risk management
o Balances the costs and benefits of managing risk

Effective management of IT risk
o Promotes fair and open communication of IT risk
o Establishes the right tone from the top while defining and enforcing personal accountability
for operating within acceptable and well-defined tolerance levels
o Is a continuous process and part of daily activities