Information Security: IT Risk Management

Original Issuance Date: October 13, 2021
Last Revision Date: November 11, 2026
Effective Date: May 1, 2027

1. Policy Purpose

This policy establishes baseline requirements for identifying, assessing, documenting, and managing information technology (IT) risks within the Universities of Wisconsin (UW). It provides a framework to ensure risks are addressed at the appropriate organizational level and that risk management activities align with institution priorities, business value, and defined risk appetite.

2. Responsible UW System Officer

Associate Vice President for Information Security

3. Scope and Institutional Responsibilities

This policy applies to all UW institutions, including UW System Administration, and encompasses IT risks arising from or affecting institution systems, services, data, processes, projects, and technology-related activities. It also applies to third-party services, cloud providers, and external data processors that store, process, or transmit institution data on behalf of the institution.

The UW System Office of Information Security will provide supporting guidance, training, and tools to promote consistent implementation of this policy across universities.

4. Background

The UW System is committed to protecting the confidentiality, integrity, and availability of its information technology resources in support of academic, research, and administrative missions. Managing IT risk is a shared responsibility across all universities and is essential to maintaining a secure and resilient technology environment.

This policy establishes a consistent, enterprise-wide approach to IT risk management, grounded in leading standards and frameworks, and adaptable to evolving threats, technologies, and regulatory expectations.

5. Definitions

Please see SYS 1000, Information Security: General Terms and Definitions, for a list of general terms and definitions. Terms and definitions found within this policy include:

Risk
Risk Appetite
Risk Owner
Residual Risk
Risk Executive
Risk Register
Risk Management
Risk Treatment

6. Policy Statement

Each institution must implement and maintain IT risk management processes that support the consistent identification, evaluation, and treatment of IT risks. Risk management activities should be prioritized based on the likelihood and potential impact of risks and must be guided by business value, operational context, and defined risk appetite. Risk response decisions must be made or approved by individuals with appropriate authority, and risks that exceed the institution’s defined risk appetite must be escalated for review and decision.

A. Risk Identification and Assessment

Each institution must establish and maintain processes to identify IT risks across the institution and its third-party relationships. Risk identification efforts should prioritize risks with the potential to significantly affect institution objectives, reputation, operations, systems, or data.

B. Risk Ownership and Decision-Making

Each IT risk documented in the institution’s designated risk register must be assigned to a designated risk owner, who is responsible for evaluating the risk and recommending appropriate response actions. Risks with residual risk that exceed the institution’s defined risk appetite must be reviewed by a designated risk executive. The risk executive is responsible for determining the appropriate response and ensuring the risk is either brought to an acceptable level or formally accepted when applicable.

C. Risk Treatment

Each identified IT risk must be addressed through an appropriate treatment strategy. Acceptable risk treatments include:

Mitigation – reducing the likelihood or impact of the risk
Transfer – shifting the risk to another party (e.g., through contracts or shared responsibility)
Avoidance – Choosing not to engage in, or discontinuing, the activity that introduces the risk
Acceptance or Acknowledgement – formally accepting the residual risk with documented justification

The selected treatment must be approved at the appropriate level, based on the institution’s defined risk appetite and delegation of authority.

D. Documentation and Registers

Institutions must maintain documentation of IT risks that warrant ongoing oversight, treatment, or decision making. Risk register records must include associated assessments, ownership, treatment decisions, and current status.

At a minimum, risks with residual risk that exceed the institution’s defined risk appetite must be formally documented in the risk register.

Institutions must also maintain documentation of decisions not to implement controls or processes required by UW information security policy or procedure. Policy exceptions that result in residual risk above the institution’s defined risk appetite must be both documented as exceptions and linked to a corresponding entry in the risk register.

Documentation must be kept current and available for review by the UW System Office of Information Security, Internal Audit, or other authorized parties.

The UW System Office of Information Security will maintain a central risk register to support awareness of system-wide risks and trends.

E. Enterprise Risk Reporting

Institutions must periodically report information regarding their most significant IT risks to the UW System Office of Information Security in accordance with SYS 1039.B, Enterprise Risk Reporting. This reporting supports system-wide visibility into significant risks, common trends, and shared exposures that may warrant additional coordination or enterprise-level consideration.