THE RISK CALL: Three entries from the same register. Exactly one describes something you could actually quantify as written: a scenario with a frequency and a magnitude worth arguing about.
ENTRY 1 · RISK-014
Quarterly access reviews not performed on production systems.
SOC 2 CC6.3 requires quarterly review; 3 of 11 systems were missed in Q2. Likelihood 3, impact 4, score 12. Treatment: implement automated review workflow.
SOC 2 CC6.3 requires quarterly review; 3 of 11 systems were missed in Q2. Likelihood 3, impact 4, score 12. Treatment: implement automated review workflow.
ENTRY 2 · RISK-021
Ransomware could severely impact business operations.
Likelihood: 4 (likely). Impact: 5 (severe). Inherent score 20, residual score 12 after controls. Appetite: low.
Likelihood: 4 (likely). Impact: 5 (severe). Inherent score 20, residual score 12 after controls. Appetite: low.
ENTRY 3 · RISK-030
Offboarded employee retains production access beyond 24h.
Deprovisioning is manual; HR-to-IT handoff misses ~2-4 leavers/yr (last 3 yrs of ticket data). If access is used: exposure est. $80k-$400k per event (support-tier data, incident response, notification). Owner: platform engineering.
Deprovisioning is manual; HR-to-IT handoff misses ~2-4 leavers/yr (last 3 yrs of ticket data). If access is used: exposure est. $80k-$400k per event (support-tier data, incident response, notification). Owner: platform engineering.
grc@ctrl-f:~$