≪ View Page

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		Previous revision
pub:trust_center:risk_framework [21.07.2026 13:28] – Risk Assessment Framework - Overview of how we manage risks Predrag Tasevskipub:trust_center:risk_framework [21.07.2026 13:57] (current) – [Risk Governance] Predrag Tasevski
Line 15: Line 15:
   * **Business continuity** — Infrastructure failures, natural disasters, vendor issues   * **Business continuity** — Infrastructure failures, natural disasters, vendor issues
  
-By systematically assessing and managing these risks, we reduce the likelihood of problems and our ability to recover quickly if they occur.+By systematically assessing and managing these risks, we reduce the likelihood of problems and improve our ability to recover quickly if they occur.
  
 ====== Our Risk Management Approach ====== ====== Our Risk Management Approach ======
  
-We use **ISO 31000** (international risk management standard) to:+We use **ISO 31000** (international risk management standard) combined with **ISO 27005** (information security risk) to:
  
 === 1. Identify Risks === === 1. Identify Risks ===
Line 50: Line 50:
 For each risk, we choose a strategy: For each risk, we choose a strategy:
  
-| Strategy | Example | +^ Strategy ^ Example ^
-|---|---|+
 | **Mitigate** | Deploy a Web Application Firewall (WAF) to reduce likelihood of exploitation | | **Mitigate** | Deploy a Web Application Firewall (WAF) to reduce likelihood of exploitation |
 | **Accept** | Accept risk of rare data center outage (handled by AWS redundancy) | | **Accept** | Accept risk of rare data center outage (handled by AWS redundancy) |
Line 65: Line 64:
   * **Access control violations** — Any unauthorized access attempts   * **Access control violations** — Any unauthorized access attempts
  
-Results are reviewed in [[pub:company:traction#level_10_meeting|monthly leadership meetings]].+Results are reviewed in [[pub:company:traction#level_10_meeting|monthly leadership meetings]] and shown on our [[pub:company:scorecard|Scorecard]].
  
 ====== Risk Categories We Manage ====== ====== Risk Categories We Manage ======
  
-| Risk Category | Examples | How We Address It | +^ Risk Category ^ Examples ^ How We Address It ^ Related Document ^ 
-|---|---|---| +| **Security Risks** | Data breach, malware, unauthorized access, unpatched vulnerability | Encryption, access control, patch management, monitoring | [[pub:trust_center:iso_27001_overview|ISO 27001]] | 
-| **Security Risks** | Data breach, malware, unauthorized access, unpatched vulnerability | Encryption, access control, patch management, monitoring | +| **Availability Risks** | Platform outage, slow performance, deployment failures | Infrastructure redundancy, testing, change management | [[pub:trust_center:iso_20000_1_overview|ISO 20000-1]] | 
-| **Availability Risks** | Platform outage, slow performance, deployment failures | Infrastructure redundancy, testing, change management | +| **Compliance Risks** | Failed audit, regulatory violation, GDPR incident notification | Security controls, incident response, compliance procedures | [[pub:trust_center:nis2_scope_determination|NIS2]], [[pub:trust_center:cra_scope_determination|CRA]] | 
-| **Compliance Risks** | Failed audit, regulatory violation, GDPR incident notification | Security controls, incident response, compliance procedures | +| **Operational Risks** | Human error, misconfiguration, contractor misuse | Training, access control, audit procedures | [[pub:company:accountability_chart|Accountability Chart]] | 
-| **Operational Risks** | Human error, misconfiguration, contractor misuse | Training, access control, audit procedures | +| **Vendor Risks** | Vendor breach, loss of service, vendor data mishandling | Vendor assessment, contracts, monitoring | [[pub:trust_center:subprocessors|Trusted Subprocessors]] |
-| **Vendor Risks** | Vendor breach, loss of service, vendor data mishandling | Vendor assessment, contracts, monitoring |+
  
 ====== Risk Governance ====== ====== Risk Governance ======
  
-| Role | Responsibility | +^ Role ^ Responsibility ^ Related Document ^ 
-|---|---| +| **CEO (Predrag)** | Approve risk appetite; allocate budget for risk mitigation; review critical risks quarterly | [[pub:company:accountability_chart|Accountability Chart]] | 
-| **CEO (Predrag)** | Approve risk appetite; allocate budget for risk mitigation; review critical risks quarterly | +| **CTO (Peter)** | Identify technical risks; implement controls; track patch deployment and incident response | [[pub:trust_center:iso_27001_overview|ISO 27001 Implementation]] | 
-| **CTO (Peter)** | Identify technical risks; implement controls; track patch deployment and incident response | +| **Operations (Alexander)** | Identify operational risks; manage access control; support incident response | [[pub:trust_center:iso_20000_1_overview|ISO 20000-1 Implementation]] | 
-| **Operations (Alexander)** | Identify operational risks; manage access control; support incident response | +| **All Employees** | Report risks or suspicious activity when discovered | [[pub:trust_center:isms_policy|Security Policy]] |
-| **All Employees** | Report risks or suspicious activity when discovered |+
  
 ====== Our Risk Appetite ====== ====== Our Risk Appetite ======
Line 109: Line 106:
   ✅ **Compliance is maintained** — We meet GDPR, NIS2, CRA, DORA requirements   ✅ **Compliance is maintained** — We meet GDPR, NIS2, CRA, DORA requirements
   ✅ **Continuous improvement** — We get better based on results and lessons learned   ✅ **Continuous improvement** — We get better based on results and lessons learned
-  ✅ **Transparency** — We report incident response time and uptime to you regularly+  ✅ **Transparency** — We report incident response time and uptime to you regularly via [[pub:company:scorecard|Scorecard]] 
 + 
 +====== Regulatory Alignment ====== 
 + 
 +Our risk management framework supports compliance with: 
 + 
 +  * [[pub:trust_center:iso_27001_overview|ISO 27001:2022]] — Risk assessment per ISO 27005 
 +  * [[pub:trust_center:iso_20000_1_overview|ISO 20000-1:2018]] — Risk management for service delivery 
 +  * [[pub:trust_center:nis2_scope_determination|NIS2 Directive]] — Article 21 cybersecurity measures 
 +  * [[pub:trust_center:cra_scope_determination|CRA Regulation]] — Risk management and incident response 
 +  * [[pub:trust_center:policies:privacy_policy|GDPR]] — Article 32 (risk assessment and mitigation)
  
 ====== See Also ====== ====== See Also ======
  
-  * [[pub:trust_center:iso_27001_overview|ISO 27001:2022 — Information Security]] +  * [[pub:trust_center:iso_27001_overview|ISO 27001:2022]] — Information Security Management System 
-  * [[pub:trust_center:iso_20000_1_overview|ISO 20000-1:2018 — Service Management]]+  * [[pub:trust_center:iso_20000_1_overview|ISO 20000-1:2018]] — Service Management System 
 +  * [[pub:trust_center:isms_policy|Information Security Policy]] — Our security commitment 
 +  * [[pub:company:service_strategy|Service Strategy]] — Service commitments and SLAs
   * [[pub:company:scorecard|Service Performance Scorecard]] — Real-time risk monitoring   * [[pub:company:scorecard|Service Performance Scorecard]] — Real-time risk monitoring
-  * [[pub:trust_center:isms_policy|Information Security Policy]]+  * [[pub:company:accountability_chart|Accountability Chart]] — Risk management roles
  
 ====== Questions? ====== ====== Questions? ======
Line 123: Line 132:
  
 → Email us: **security@unicis.tech** → Email us: **security@unicis.tech**
 +
 +----
 +
 +==== Navigation ====
 +
 +← [[pub:trust_center|Trust Center]] | [[pub:trust_center:isms_policy|Information Security Policy →]]
  
 ---- ----