Risk Assessment

The "is_risk" entry in the FFIEC IT Examination Handbook outlines how financial institutions must conduct a formal risk assessment of their information systems, identifying threats, vulnerabilities, and potential impacts on confidentiality, integrity, and availability. It requires documenting risk-based mitigation plans and regularly updating the assessment to reflect changes in the environment.