Pro Tip: Core Workflow Act Process

Introduction

This DecipherRisk™️ Pro Tip article provides expert guidance, with examples, on how to take action (Act) on risk issues in the system. 

DecipherRisk™️ Core Workflow

ACT Process 

The primary purpose of the ACT Process, is to decide on what action to take based on the issue Priority assigned. 
The Priority Level determines if the issue

• needs immediate action (e.g., risk analysis or development of an action plan)
• will be deferred to a future date or
• will not have a material negative impact and can be closed.

ACT Process Tasks

The ACT process involves one or more of the following tasks:

Establish Resolution Criteria - The conditions that must be met to consider the issue resolved (i.e., closed). All high and critical priority Issues should have defined Resolution Criteria.
Develop Action Plan(s) with Tasks - Action Plans are the work that needs to be done to address the Issue.  Tasks are the activities needed to complete the work.
Conduct Risk Analysis - Additional analysis of an Issue may be necessary to estimate the risk associated with an Issue.
Defer Issues - When the organization has Critical or High Issues, less pressing Issues (i.e., Low and Medium priority) can be deferred to a future date.
Review Deferred Issues (as necessary) - A deferred Issue should be reviewed at the NEXT REVIEW date to verify the issue conditions/assumptions used to set the Priority (impact and urgency) have not changed. 

Pro Tip: When conducting an Issue Review, document the following: 1) who conducted the review, 2) the review date, and 3) the outcome/conclusion from the review in the Issue NOTES field.

Example: Action Plan record 

Title: InfoSec Policy Update

Estimated Effort: 8 hours

Description: 

Resolution Criteria

1. Update Policy
2. Policy reviewed by CISO or appointee.
3. Policy changes approved by InfoSec steering committee
4. Employees are notified about policy changes and acknowledge reading.

Resources: 

Notes: 

Owner:  Jack Moss

Priority:  Medium

Start Date:  9/26/2023

Due Date:  10/21/2023

Review Date:  10/10/2023