11.10

Control Activities

Principle 11 - Design General Control Activities over Information Technology

Attribute 11.10 - Security management is the ongoing process for mitigating information security risks as part of the entity's overall internal control system (sometimes referred to as a security management program). This ongoing process covers all components of internal control related to information security risks.