Export the risk register as a baseline

Purpose

This Policy sets how Tidewell IT finds, rates, treats, and accepts information security risks, so that decisions about security measures rest on facts and not on habit.

Scope

This Policy covers risks to the confidentiality, integrity, and availability of information and services inside the ISMS scope, including risks that come from suppliers, projects, and changes.

Policy statements

Method

1. We rate a risk as likelihood from 1 to 5 times impact from 1 to 5. A score up to 4 is Low, up to 9 is Medium, up to 14 is High, and above 14 is Critical.
2. We apply the same method to every risk so that scores can be compared.
3. The owner agrees each score in a short review with the ISMS Manager, and the reason for the score is written down.

Identification

1. Risks are identified from assets, suppliers, incidents, audits, changes, and the issues and needs of interested parties.
2. Anyone may propose a risk to the ISMS Manager at any time.
3. The Risks register is refreshed whenever the asset inventory or the supplier list changes.

Risk owners

1. Every Risk has an owner, who is a named person with the authority to act on it.
2. The owner keeps the Risk current and answers for its treatment.
3. When an owner leaves or changes role, the ISMS Manager assigns a new owner within 5 working days.

Treatment

1. For each Risk the owner chooses one of four options: reduce it with controls, avoid it by stopping the activity, share it with a supplier or an insurer, or accept it.
2. High and Critical Risks need a treatment plan or acceptance by the Management Board.
3. Decisions on every control of ISO/IEC 27001:2022 Annex A are recorded with a justification, whether the control applies or not.

Acceptance

1. The risk owner accepts Low Risks. The ISMS Manager accepts Medium Risks.
2. Only the Management Board accepts High and Critical Risks, and it records the reason and a date for the next look.
3. An acceptance that no longer fits, because the Risk grew or the situation changed, is withdrawn and the Risk is treated.

Opportunities

1. Opportunities that improve security or service are recorded in the Opportunities register, with an owner and a decision.
2. Opportunities are weighed against the same objectives as risks and are reviewed together with them.

Review

1. Each Risk is reviewed at the cadence set for the Account, and again after an incident, a significant change, or a new supplier.
2. The ISMS Manager reports the risk picture to the Management Board in every management review.

Roles and responsibilities

The ISMS Manager owns this Policy and the method. Risk owners rate and treat their Risks. The Management Board accepts High and Critical Risks and provides the resources for treatment. The Internal Auditor checks that the method is followed.

Exceptions

An exception to the method needs a written request to the ISMS Manager that states the reason, the risk, and an end date. The Management Board approves it.

Compliance and enforcement

A Risk without an owner, or a High or Critical Risk without a plan or an acceptance, is raised as a Finding in the next internal audit. Breaches of this Policy lead to disciplinary measures under the HR process.

Related documents

• Information Security Policy
• Supplier Security Policy
• Vulnerability and Patch Management Procedure
• Internal Audit and Management Review Procedure

Review

The ISMS Manager reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.