The Information Security Ad-Hoc Risk Reporting Process provides a mechanism to report, evaluate, and manage information security risks identified outside formal risk assessment activities.
Faculty, staff, ITS personnel, project teams, auditors, service owners, vendors, and other stakeholders may identify risks, and Information Security reviews them to determine potential impact, appropriate treatment options, and reporting requirements.