When should risk assessments be performed?

1. During product selection (inherit Risk Assessment).
2. Once a product is stable – approximately 6-8 weeks post implementation. (Current Risk Assessment) 

At least annually or after significant change, including post-retirement. To request assistance in conducting a risk assessment please contact Privacy@theiia.org.