{"id":1119,"date":"2026-05-29T11:06:22","date_gmt":"2026-05-29T16:06:22","guid":{"rendered":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/?page_id=1119"},"modified":"2026-05-29T11:13:19","modified_gmt":"2026-05-29T16:13:19","slug":"information-security-risk-management-frequently-asked-questions-faq","status":"publish","type":"page","link":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/information-security-risk-management-frequently-asked-questions-faq\/","title":{"rendered":"Information Security Risk Management\u2014Frequently Asked Questions (FAQ)"},"content":{"rendered":"    <section class=\"cc--component-container cc--hero-basic  hero-basic color-light-gray\">\n\n<div class=\"c--component c--hero-basic\">\n        \n<div class=\"outer-wrapper\">\n    <div class=\"inner-wrapper\">\n        <div class=\"text-container\">\n            <div class=\"text-wrapper\">\n\t\t\t\t<div class=\"f--field f--page-title \"><h1>Information Security Risk Management\u2014Frequently Asked Questions (FAQ)<\/h1>\n\n<\/div><!-- f--field f--page-title -->\n\t\t\t\t<div class=\"f--field f--text \"><\/div><!-- f--field f--text -->\n            <\/div>\n        <\/div>\n    <\/div>\n<\/div>\n\n\n<\/div><!-- c--component c--hero-basic -->\n\n    <\/section><!-- cc--component-container cc--section -->\n\n\n    <section class=\"cc--component-container cc--accordion red justify-left  accordion\" id='getting-started'>\n\n<div class=\"c--component c--accordion\">\n        <section class=\"wp-block section\">\n    <div class=\"inner-wrapper\">\n        <header class=\"section-header\">\n            <div class=\"f--field f--section-title \"><h2>\n            Getting started    <\/h2>\n<\/div><!-- f--field f--section-title -->\n        <\/header>\n                    <ul class=\"accordion-list accordion-title--left\">\n                \n                    <li class=\"accordion-list-item\" id=\"-when-should-i-engage-the-information-security-risk-management-office\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c6258885d-0\" aria-controls=\"section-6a66c6258885d-0\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                         When should I engage the Information Security Risk Management office?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c6258885d-0\" role=\"region\" aria-labelledby=\"heading-6a66c6258885d-0\" class=\"accordion-panel\">\n                            <p>As early as possible\u2014ideally during planning or vendor selection\u2014so we can identify risks before contracts are signed or code goes live. Early engagement helps avoid delays later.<\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=-when-should-i-engage-the-information-security-risk-management-office\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                \n                    <li class=\"accordion-list-item\" id=\"what-types-of-engagements-require-a-risk-assessment\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c6258885d-1\" aria-controls=\"section-6a66c6258885d-1\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        What types of engagements require a risk assessment?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c6258885d-1\" role=\"region\" aria-labelledby=\"heading-6a66c6258885d-1\" class=\"accordion-panel\">\n                            <p>Any engagement involving third-party vendors, cloud services, new software tools, or sensitive data (e.g., student records, health data, financial systems) should be assessed. When in doubt, contact us\u2014we\u2019d rather double-check than miss something important.<\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=what-types-of-engagements-require-a-risk-assessment\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                            <\/ul>\n            <\/div>\n<\/section><\/div><!-- c--component c--accordion -->\n\n    <\/section><!-- cc--component-container cc--section -->\n\n\n    <section class=\"cc--component-container cc--accordion red justify-left  accordion\" id='assessment-process'>\n\n<div class=\"c--component c--accordion\">\n        <section class=\"wp-block section\">\n    <div class=\"inner-wrapper\">\n        <header class=\"section-header\">\n            <div class=\"f--field f--section-title \"><h2>\n            Assessment process    <\/h2>\n<\/div><!-- f--field f--section-title -->\n        <\/header>\n                    <ul class=\"accordion-list accordion-title--left\">\n                \n                    <li class=\"accordion-list-item\" id=\"how-long-does-a-third-party-risk-assessment-take\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62588f24-0\" aria-controls=\"section-6a66c62588f24-0\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        How long does a Third-Party Risk Assessment take?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62588f24-0\" role=\"region\" aria-labelledby=\"heading-6a66c62588f24-0\" class=\"accordion-panel\">\n                            <p>Our standard Service-Level Agreement (SLA) is 7\u201320 business days, depending on data sensitivity, risk complexity, and vendor responsiveness. Submitting your request early gives us time to keep you on schedule.<\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=how-long-does-a-third-party-risk-assessment-take\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                \n                    <li class=\"accordion-list-item\" id=\"what-information-do-i-need-to-provide\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62588f24-1\" aria-controls=\"section-6a66c62588f24-1\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        What information do I need to provide?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62588f24-1\" role=\"region\" aria-labelledby=\"heading-6a66c62588f24-1\" class=\"accordion-panel\">\n                            <p>We\u2019ll need:<\/p>\n<ul>\n<li>A brief description of the project or vendor<\/li>\n<li>Data classification (Restricted, Confidential, Internal, or Public)<\/li>\n<li>Hosting details (e.g., cloud vs. on-premises)<\/li>\n<li>Any vendor-provided security documentation (SOC 2 report, HECVAT, SIG questionnaire, etc.)<\/li>\n<\/ul>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=what-information-do-i-need-to-provide\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                \n                    <li class=\"accordion-list-item\" id=\"why-do-you-ask-for-security-certifications-or-documents-from-vendors\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62588f24-2\" aria-controls=\"section-6a66c62588f24-2\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        Why do you ask for security certifications or documents from vendors?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62588f24-2\" role=\"region\" aria-labelledby=\"heading-6a66c62588f24-2\" class=\"accordion-panel\">\n                            <p>Security certifications like SOC 2, ISO 27001, or completed questionnaires help us assess the vendor\u2019s controls and identify potential weaknesses. This saves time and allows for more accurate risk analysis.<\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=why-do-you-ask-for-security-certifications-or-documents-from-vendors\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                \n                    <li class=\"accordion-list-item\" id=\"does-the-information-security-risk-management-office-approve-or-deny-projects\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62588f24-3\" aria-controls=\"section-6a66c62588f24-3\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        Does the Information Security Risk Management office approve or deny projects?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62588f24-3\" role=\"region\" aria-labelledby=\"heading-6a66c62588f24-3\" class=\"accordion-panel\">\n                            <p>No. We provide risk-based insights and recommendations. Final go\/no-go decisions\u2014and acceptance of any remaining risk\u2014remain with your department or business unit.<\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=does-the-information-security-risk-management-office-approve-or-deny-projects\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                \n                    <li class=\"accordion-list-item\" id=\"can-i-still-move-forward-if-risks-are-identified\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62588f24-4\" aria-controls=\"section-6a66c62588f24-4\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        Can I still move forward if risks are identified?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62588f24-4\" role=\"region\" aria-labelledby=\"heading-6a66c62588f24-4\" class=\"accordion-panel\">\n                            <p>Yes, provided your department formally acknowledges and accepts the remaining risk. We document these risks and may recommend additional controls, ongoing monitoring, or scheduled reassessments.<\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=can-i-still-move-forward-if-risks-are-identified\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                            <\/ul>\n            <\/div>\n<\/section><\/div><!-- c--component c--accordion -->\n\n    <\/section><!-- cc--component-container cc--section -->\n\n\n    <section class=\"cc--component-container cc--accordion red justify-left  accordion\" id='after-the-assessment'>\n\n<div class=\"c--component c--accordion\">\n        <section class=\"wp-block section\">\n    <div class=\"inner-wrapper\">\n        <header class=\"section-header\">\n            <div class=\"f--field f--section-title \"><h2>\n            After the assessment    <\/h2>\n<\/div><!-- f--field f--section-title -->\n        <\/header>\n                    <ul class=\"accordion-list accordion-title--left\">\n                \n                    <li class=\"accordion-list-item\" id=\"what-happens-after-the-assessment-is-complete\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62589386-0\" aria-controls=\"section-6a66c62589386-0\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        What happens after the assessment is complete?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62589386-0\" role=\"region\" aria-labelledby=\"heading-6a66c62589386-0\" class=\"accordion-panel\">\n                            <p>You\u2019ll receive a formal report outlining identified risks, suggested mitigations, and a residual risk score. If action is needed, we\u2019ll track it through follow-up reviews or recertification as appropriate.<\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=what-happens-after-the-assessment-is-complete\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                \n                    <li class=\"accordion-list-item\" id=\"where-can-i-track-my-request\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62589386-1\" aria-controls=\"section-6a66c62589386-1\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        Where can I track my request?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62589386-1\" role=\"region\" aria-labelledby=\"heading-6a66c62589386-1\" class=\"accordion-panel\">\n                            <ul>\n<li>If you submitted via ServiceNow, you can track progress and communicate with our team through the Rutgers IT Service portal.<\/li>\n<li>If you used the Work Intake Form, updates will be shared through email as your request moves through our queue.<\/li>\n<\/ul>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=where-can-i-track-my-request\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                            <\/ul>\n            <\/div>\n<\/section><\/div><!-- c--component c--accordion -->\n\n    <\/section><!-- cc--component-container cc--section -->\n\n\n    <section class=\"cc--component-container cc--accordion red justify-left  accordion\" id='additional-topics'>\n\n<div class=\"c--component c--accordion\">\n        <section class=\"wp-block section\">\n    <div class=\"inner-wrapper\">\n        <header class=\"section-header\">\n            <div class=\"f--field f--section-title \"><h2>\n            Additional topics    <\/h2>\n<\/div><!-- f--field f--section-title -->\n        <\/header>\n                    <ul class=\"accordion-list accordion-title--left\">\n                \n                    <li class=\"accordion-list-item\" id=\"-are-there-fees-for-assessments\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62589bed-0\" aria-controls=\"section-6a66c62589bed-0\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                         Are there fees for assessments?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62589bed-0\" role=\"region\" aria-labelledby=\"heading-6a66c62589bed-0\" class=\"accordion-panel\">\n                            <p>No. All core risk assessment services are provided at no cost to Rutgers departments.<\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=-are-there-fees-for-assessments\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                \n                    <li class=\"accordion-list-item\" id=\"what-if-a-vendor-fails-the-assessment\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62589bed-1\" aria-controls=\"section-6a66c62589bed-1\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        What if a vendor \u201cfails\u201d the assessment?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62589bed-1\" role=\"region\" aria-labelledby=\"heading-6a66c62589bed-1\" class=\"accordion-panel\">\n                            <p>We don\u2019t issue pass\/fail grades. We highlight risks and provide recommendations. If risk cannot be mitigated to an acceptable level, we\u2019ll help you evaluate alternative options or protections.<\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=what-if-a-vendor-fails-the-assessment\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                \n                    <li class=\"accordion-list-item\" id=\"how-does-the-information-security-risk-management-office-classify-data\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62589bed-2\" aria-controls=\"section-6a66c62589bed-2\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        How does the Information Security Risk Management office classify data?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62589bed-2\" role=\"region\" aria-labelledby=\"heading-6a66c62589bed-2\" class=\"accordion-panel\">\n                            <p>We follow Rutgers\u2019 Information Classification Policy, which includes:<\/p>\n<ul>\n<li>Public \u2013 General access data<\/li>\n<li>Internal \u2013 Operational data not intended for public distribution<\/li>\n<li>Confidential \u2013 Sensitive business data (e.g., HR, finance)<\/li>\n<li>Restricted \u2013 Regulated data like SSNs, health records, or financial aid data<\/li>\n<\/ul>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=how-does-the-information-security-risk-management-office-classify-data\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                \n                    <li class=\"accordion-list-item\" id=\"what-are-vulnerabilities-in-cybersecurity\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62589bed-3\" aria-controls=\"section-6a66c62589bed-3\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        What are vulnerabilities in cybersecurity?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62589bed-3\" role=\"region\" aria-labelledby=\"heading-6a66c62589bed-3\" class=\"accordion-panel\">\n                            <p>A vulnerability is a weakness or flaw in a system, application, network, or physical environment that an adversary can exploit to gain unauthorized access, disrupt operations, or compromise data. These weaknesses can be found in software code, hardware configurations, physical security controls, or even human processes.<\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=what-are-vulnerabilities-in-cybersecurity\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                \n                    <li class=\"accordion-list-item\" id=\"what-is-the-cisa-kev-list\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62589bed-4\" aria-controls=\"section-6a66c62589bed-4\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        What is the CISA KEV list?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62589bed-4\" role=\"region\" aria-labelledby=\"heading-6a66c62589bed-4\" class=\"accordion-panel\">\n                            <p>The CISA KEV list refers to the Known Exploited Vulnerabilities (KEV) Catalog maintained by the Cybersecurity and Infrastructure Security Agency (CISA). It includes vulnerabilities that are actively being exploited by malicious actors in the real world.<\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=what-is-the-cisa-kev-list\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                \n                    <li class=\"accordion-list-item\" id=\"what-is-the-cvss-scoring-system\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62589bed-5\" aria-controls=\"section-6a66c62589bed-5\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        What is the CVSS Scoring System?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62589bed-5\" role=\"region\" aria-labelledby=\"heading-6a66c62589bed-5\" class=\"accordion-panel\">\n                            <p>The Common Vulnerability Scoring System (CVSS) is used to assess the severity of vulnerabilities. Scores range from 0.0 to 10.0, with higher scores indicating more severe vulnerabilities.<\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=what-is-the-cvss-scoring-system\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                \n                    <li class=\"accordion-list-item\" id=\"how-does-rutgers-use-cvss-scores\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62589bed-6\" aria-controls=\"section-6a66c62589bed-6\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        How does Rutgers use CVSS scores?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62589bed-6\" role=\"region\" aria-labelledby=\"heading-6a66c62589bed-6\" class=\"accordion-panel\">\n                            <p>Rutgers utilizes vulnerability management tools that apply the Common Vulnerability Scoring System (CVSS) to prioritize remediation actions. Vulnerabilities are categorized as Critical, Severe, or Moderate based on their CVSS scores.<\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=how-does-rutgers-use-cvss-scores\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                \n                    <li class=\"accordion-list-item\" id=\"what-is-the-nist-cve-classification-system\">\n                        <button type=\"button\" class=\"accordion-trigger \" id=\"heading-6a66c62589bed-7\" aria-controls=\"section-6a66c62589bed-7\" aria-expanded=\"false\" aria-disabled=\"false\">\n                            <h3>                        <i class=\"\"\" style=\"color: #CC0033\"><\/i>\n                        What is the NIST CVE Classification System?<\/h3>\n                        <\/button>\n                        <div id=\"section-6a66c62589bed-7\" role=\"region\" aria-labelledby=\"heading-6a66c62589bed-7\" class=\"accordion-panel\">\n                            <p>The National Institute of Standards and Technology (NIST) maintains the National Vulnerability Database (NVD), which uses the Common Vulnerabilities and Exposures (CVE) system. Each vulnerability is assigned a unique CVE ID to help organizations track and manage them.<br \/>\nExplore the CVE system:<\/p>\n<p><a href=\"https:\/\/www.nist.gov\/itl\/nvd\">NIST National Vulnerability Database (NVD)<\/a><br \/>\n<a href=\"https:\/\/www.cve.org\/\">CVE Program Official Site<\/a><\/p>\n\n                            <p><i  style=\"font-size: 0.9rem;\" class=\"fa-sharp-duotone fa-solid fa-link\"><\/i>\n                                <a  style=\"font-size: 0.9rem;\" class=\"copy-accordion-link\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119?panel=what-is-the-nist-cve-classification-system\">Link\n                                    to this item <span><\/span><\/a><\/p>\n                        <\/div>\n\n                    <\/li>\n                            <\/ul>\n            <\/div>\n<\/section><\/div><!-- c--component c--accordion -->\n\n    <\/section><!-- cc--component-container cc--section -->\n\n\n    <section class=\"cc--component-container cc--special-announcement  cta-banner color-white\">\n\n<div class=\"c--component c--special-announcement\">\n        \n<div class=\"inner-wrapper\">\n    <div class=\"text-wrapper\">\n        <div class=\"f--field f--section-title \"><h2>\n                <\/h2>\n<\/div><!-- f--field f--section-title -->\n<div class=\"f--field f--description \"><p>Can\u2019t find what you\u2019re looking for? <a href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/contact-the-information-security-risk-management-office\/\">Contact Us<\/a> and we\u2019ll respond within one business day.<\/p>\n<\/div><!-- f--field f--description -->\n    <\/div>\n\n    <div class=\"button-wrapper\">\n        \n            <\/div>\n<\/div>\n\n<style>\n    .cta-banner .inner-wrapper {\n        display: flex;\n        justify-content: space-between;\n    }\n\n    .cta-banner .inner-wrapper .button-wrapper {\n        align-items: center;\n        display: flex;\n        gap: 30px;\n    }\n<\/style><\/div><!-- c--component c--special-announcement -->\n\n    <\/section><!-- cc--component-container cc--section -->\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":992,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"page-category":[],"class_list":["post-1119","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Information Security Risk Management\u2014Frequently Asked Questions (FAQ) - Cybersecurity Risk Management Program<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/information-security-risk-management-frequently-asked-questions-faq\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Information Security Risk Management\u2014Frequently Asked Questions (FAQ) - Cybersecurity Risk Management Program\" \/>\n<meta property=\"og:url\" content=\"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/information-security-risk-management-frequently-asked-questions-faq\/\" \/>\n<meta property=\"og:site_name\" content=\"Cybersecurity Risk Management Program\" \/>\n<meta property=\"article:modified_time\" content=\"2026-05-29T16:13:19+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/it.rutgers.edu\\\/cybersecurity-risk-management-program\\\/information-security-risk-management-frequently-asked-questions-faq\\\/\",\"url\":\"https:\\\/\\\/it.rutgers.edu\\\/cybersecurity-risk-management-program\\\/information-security-risk-management-frequently-asked-questions-faq\\\/\",\"name\":\"Information Security Risk Management\u2014Frequently Asked Questions (FAQ) - Cybersecurity Risk Management Program\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/it.rutgers.edu\\\/cybersecurity-risk-management-program\\\/#website\"},\"datePublished\":\"2026-05-29T16:06:22+00:00\",\"dateModified\":\"2026-05-29T16:13:19+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/it.rutgers.edu\\\/cybersecurity-risk-management-program\\\/information-security-risk-management-frequently-asked-questions-faq\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/it.rutgers.edu\\\/cybersecurity-risk-management-program\\\/information-security-risk-management-frequently-asked-questions-faq\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/it.rutgers.edu\\\/cybersecurity-risk-management-program\\\/information-security-risk-management-frequently-asked-questions-faq\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"LinkedIn Learning\",\"item\":\"https:\\\/\\\/it.rutgers.edu\\\/cybersecurity-risk-management-program\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Information Security Risk Management\u2014Frequently Asked Questions (FAQ)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/it.rutgers.edu\\\/cybersecurity-risk-management-program\\\/#website\",\"url\":\"https:\\\/\\\/it.rutgers.edu\\\/cybersecurity-risk-management-program\\\/\",\"name\":\"Cybersecurity Risk Management Program\",\"description\":\"A Rutgers IT Service\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/it.rutgers.edu\\\/cybersecurity-risk-management-program\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Information Security Risk Management\u2014Frequently Asked Questions (FAQ) - Cybersecurity Risk Management Program","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/information-security-risk-management-frequently-asked-questions-faq\/","og_locale":"en_US","og_type":"article","og_title":"Information Security Risk Management\u2014Frequently Asked Questions (FAQ) - Cybersecurity Risk Management Program","og_url":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/information-security-risk-management-frequently-asked-questions-faq\/","og_site_name":"Cybersecurity Risk Management Program","article_modified_time":"2026-05-29T16:13:19+00:00","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/information-security-risk-management-frequently-asked-questions-faq\/","url":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/information-security-risk-management-frequently-asked-questions-faq\/","name":"Information Security Risk Management\u2014Frequently Asked Questions (FAQ) - Cybersecurity Risk Management Program","isPartOf":{"@id":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/#website"},"datePublished":"2026-05-29T16:06:22+00:00","dateModified":"2026-05-29T16:13:19+00:00","breadcrumb":{"@id":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/information-security-risk-management-frequently-asked-questions-faq\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/information-security-risk-management-frequently-asked-questions-faq\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/information-security-risk-management-frequently-asked-questions-faq\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"LinkedIn Learning","item":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/"},{"@type":"ListItem","position":2,"name":"Information Security Risk Management\u2014Frequently Asked Questions (FAQ)"}]},{"@type":"WebSite","@id":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/#website","url":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/","name":"Cybersecurity Risk Management Program","description":"A Rutgers IT Service","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/users\/992"}],"replies":[{"embeddable":true,"href":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/comments?post=1119"}],"version-history":[{"count":10,"href":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119\/revisions"}],"predecessor-version":[{"id":1129,"href":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/pages\/1119\/revisions\/1129"}],"wp:attachment":[{"href":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/media?parent=1119"}],"wp:term":[{"taxonomy":"page-category","embeddable":true,"href":"https:\/\/it.rutgers.edu\/cybersecurity-risk-management-program\/wp-json\/wp\/v2\/page-category?post=1119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}