Risk management policy
Version0.1 draft
OwnerSecurity Owner
ReviewYearly
Applies toThe in-scope system and the company processes that support it
Risk assessment#
- A risk assessment runs at least yearly and whenever there is a significant change: a new product in scope, a new vendor of High tier, a new region, a new data class, an infrastructure move, or a severity 1 incident RSK-01, RSK-03.
- It considers threats (external attack, insider misuse, vendor failure, error, natural events, fraud), vulnerabilities (from scans, pentests, incidents, the gap assessment), and the commitments in 06 System description.
- Fraud risk is assessed explicitly (CC3.3): misuse of payment and invoicing functions, manipulated access reviews, falsified evidence, and misuse of customer data by personnel.
- Each risk is scored for likelihood (1 to 5) and impact (1 to 5). Score = likelihood times impact.
Treatment#
| Score | Treatment required |
|---|---|
| 15 to 25 | Mitigate before the next audit period starts, or a director signs an acceptance |
| 8 to 14 | Owner and plan within 90 days |
| 1 to 7 | Accept and monitor |
Each risk has an owner, a treatment (mitigate, transfer, accept, avoid), linked controls, and a target date RSK-02. Accepted risks are signed by a director with a review date no more than 12 months away.
Register#
The register is kept in the source repository at soc2-internal/risk-register.md and is not published, because it describes weaknesses. It is shared with the auditor under NDA.
Insurance#
Cyber liability and technology errors and omissions insurance are evaluated yearly; the decision is recorded RSK-04.