DAI-IRSA Scoring Model | Information Security and Enterprise Architecture
Unit Data Asset Inventory and Information Risk Self-Assessment (DAI-IRSA)
DAI-IRSA Guidance
DAI-IRSA Scoring Model
Use this scoring model to assess your risk management activities in the DAI-IRSA surveys. The model is intended to assist you in identifying:
gaps in your information risk management practices
actions you can take to improve your information risk management program
0 - Non-Existent
This practice has not been implemented or we don’t know if it has been implemented for our division or unit.
For quantifiable controls: requires 0-9% coverage.
1 - Partially Implemented
This practice has been partially implemented in our division or unit, however major aspects of its implementation remain and there are significant outstanding issues identified in some combination of:
coverage across departments
coverage across information systems
defined processes and responsibilities
resources for staffing & budget
tools to automate or support effective management
For quantifiable controls: requires 10-49% coverage.
2 - Mostly Implemented
This practice is mostly, but not fully implemented in our division or unit; minor, outstanding issues remain in some combination of:
3 - Fully Implemented
This practice is fully implemented across the division or unit, with no outstanding issues and evidence* to demonstrate:
For quantifiable controls: requires 75-100% coverage.
*NOTE: It is not a requirement to provide evidence for a self-assessment; however, ensuring you have evidence and an understanding where you may have gaps will help you develop a resilient and comprehensive information risk management program. Evidence that may demonstrate management of a particular process will depend on the specific practice and the tools used.
Configuration files and system settings
Employee lists and job descriptions
Signed approvals or agreements
User or account lists and permission settings
Data and system asset inventories
4 - Managed and Measurable
The practice is fully implemented across the division or unit with no outstanding issues and the following additional process management practices:
Appropriately resourced for staffing and budgets
Tools are leveraged to provide metrics
Process is regularly reviewed for effectiveness based on measurable objectives
Process is updated and enhanced based on impact and effectiveness metrics
The question or the risk area is not applicable to the unit or division.
The risk area is managed by another unit in the University.
See the related training video on our website here.
Inventory and Assessment Tool
Tips for Conducting a Successful Assessment
Information Risk Categories
Project Information Risk Management Assessment
Divisional Risk Assessment
Divisional Information Risk Management Program Assistance
Information Retention Schedules