THE RISK CALL: Three register entries, and this time all three have numbers. Exactly one is a quantification you could take into a decision meeting: the other two are numeric theatre. Pick the one that would survive an argument.
ENTRY 1 · RISK-007
Third-party SaaS outage disrupts customer support.
Likelihood 4 × Impact 5 = inherent 20. Control effectiveness assessed at 40%, residual = 12. Trend: stable. Review: annual.
Likelihood 4 × Impact 5 = inherent 20. Control effectiveness assessed at 40%, residual = 12. Trend: stable. Review: annual.
ENTRY 2 · RISK-019
Ransomware event on corporate infrastructure.
Annualised loss expectancy: $1,247,500 (vendor risk platform, proprietary model). Confidence: high. Treatment: accept within appetite.
Annualised loss expectancy: $1,247,500 (vendor risk platform, proprietary model). Confidence: high. Treatment: accept within appetite.
ENTRY 3 · RISK-024
Phishing-led credential compromise of the finance SaaS stack.
Frequency: 1-3 events/yr (18 months of IR tickets: 2 confirmed, 3 near-miss; industry base rate cross-checked). Loss per event: $25k-$150k, 90% CI (wire-fraud exposure capped by dual approval, IR hours, customer notification). Decision attached: fund FIDO2 rollout for finance vs raise cyber policy excess.
Frequency: 1-3 events/yr (18 months of IR tickets: 2 confirmed, 3 near-miss; industry base rate cross-checked). Loss per event: $25k-$150k, 90% CI (wire-fraud exposure capped by dual approval, IR hours, customer notification). Decision attached: fund FIDO2 rollout for finance vs raise cyber policy excess.
grc@ctrl-f:~$