Risk Register

Appropriate contacts are not maintained resulting in delays in breach response and reporting.

Appropriate contacts with interest groups are not maintained resulting in a lack of understanding of current threats.

Assets are not identified and protected according to company requirements.

Background verification checks are not carried out on all candidates or are not proportional to the business requirements or the classification of the information to be accessed by the role resulting in increased risk of malicious insider threats.

Bad actor poses as CEO and demands transfer of funds.

Company data is breached due to human error and/or misunderstanding of company requirements.

Company data is breached during a disaster due to control failures.

Company data is breached, corrupted or made unavailable due to a malware attack.

Company records are altered due to lack of proper access controls, segregation of duties, and/or supervision.

Company systems and data are breached by a company vendor.

Company systems and data are breached by unauthorized persons due to improper use of encryption.

Company systems and data are breached by unauthorized persons via a vulnerability in non-production systems or networks.

Company systems and data are breached in a non-production environment.

Company systems and data are breached or destroyed due to a natural disaster or malicious attack.

Consent for processing of PII is not captured and can't be demonstrated when needed.

Critical records are lost or destroyed leading to fines and/or loss of business.

Employees do not return equipment at termination resulting in a loss of resources and/or breach of company data.

Equipment failures result in unavailability of critical company data and systems.

Incident response is slow and ineffective.

Insufficient customer contract language does not enable legal basis for international transfer of PII.

Personnel fraudulently alter information security records due to excessive pressures from management to perform on external audits.

Personnel fraudulently establish or pay vendors due to lack of dual approval controls in the accounts payable process.

Personnel have not received training on how to manage PII and/or respond to privacy requests.

Personnel mishandle data due to a misunderstanding of the company requirements.