IT risks establish the right tone at the top while defining and enforcing accountability are a continuous process and part of daily activities IT risk communication components Major IT risk communication flows are: Expectation: what the organization expects as final result and what are the expected behaviour of employee and management; It encompasses strategy, policies, procedures, awareness training Capability: it indicates how the organization is able to manage the risk Status: information of the actual status of IT risk; It encompasses risk profile of the organization, key risk indicator (KRI), events, root cause of loss events. An effective information should be: Clear Concise Useful Timely Aimed at the correct target audience Available on a need to know basis Risk IT domains and processes The three domains of the Risk IT framework are listed below with the contained processes (three by domain); each process contains a number of activities: Risk Governance: Ensure that IT risk management practices are embedded in the enterprise, enabling it to secure optimal risk-adjusted return. It is based on the following processes: RG1 Establish and Maintain a Common Risk View RG1.1 Perform enterprise IT risk assessment RG1.2 Propose IT risk tolerance thresholds RG1.3 Approve IT risk tolerance RG1.4 Align IT risk policy RG1.5 Promote IT risk aware culture RG1.6 Encourage effective communication of IT risk RG2 Integrate With ERM RG2.1 Establish and maintain accountability for IT risk management RG2.2 Coordinate IT risk strategy and business risk strategy RG2.3 Adapt IT risk practices to enterprise risk practices RG2.4 Provide adequate resources for IT risk management RG2.5 Provide independent assurance over IT risk management RG3 Make Risk-aware Business Decisions RG3.1 Gain management buy in for the IT risk analysis approach RG3.2 Approve IT risk analysis RG3.3 Embed IT risk consideration in strategic business decision making RG3.4 Accept IT risk RG3.5 Prioritise IT risk response activities Risk Evaluation: Ensure that IT-related risks and opportunities are identified, analysed and presented in business terms. It is based on the following processes: RE1 Collect Data RE1.1 Establish and maintain a model for data collection RE1.2 Collect data on the operating environment RE1.3 Collect data on risk events RE1.4 Identify risk factors RE2 Analyse Risk RE2.1 Define IT risk analysis scope RE2.2 Estimate IT risk RE2.3 Identify risk response options RE2.4 Perform a peer review of IT risk analysis RE3 Maintain Risk Profile RE3.1 Map IT resources to business processes RE3.2 Determines business criticality