| Impact → |
Negligible
(A) |
Marginal
(B) |
Considerable
(C) |
Critical
(D) |
Catastrophic
(E) | |
|---|---|---|---|---|---|---|
| Consequence | Environment (IE) | Slight effect | Minor effect | Localized effect | Major effect | Massive effect |
| Asset (IA) | Slight damage | Minor damage | Medium damage | Major damage | Extensive damage | |
| Health (IH) | Slight physical or mental harm | Minor physical or mental harm | Major physical or mental harm | Single fatality | Multiple fatalities | |
| Business continuity (IB) | Minor visible or barely recognizable disruption of service | Recognizable temporary disruption of service | Minor functional (permanent) disruption of service | Major functional (permanent) disruption of service | Complete outage of service | |
| Data protection (ID) | No data loss / no data disclosure | Loss of rebuildable secondary data, disclosure of public data | Loss of easily recoverable data, disclosure of internal data | Loss of recoverable data, disclosure of some protected data | Irrecoverable data loss, full disclosure of protected data | |
| ↓ Probability (within 5yrs) |
Certain (5) 81-100% |
A5 | B5 | C5 | D5 | E5 |
| Likely (4) 61-80% |
A4 | B4 | C4 | D4 | E4 | |
| Possible (3) 41-60% |
A3 | B3 | C3 | D3 | E3 | |
| Unlikely (2) 21-40% |
A2 | B2 | C2 | D2 | E2 | |
| Improbable (1) 0-20% |
A1 | B1 | C1 | D1 | E1 |
| Mitigated risk | Original risk | ||||||
|---|---|---|---|---|---|---|---|
| Factor | B3 | ID | AS1 | Affects | Asset
Data protection |
Factor | C3 |
| Level | Low | Discovered on | 2021-11-26 | Owner | User:Parnoux | Level | Medium |
| Probability | Possible | Domain | External | Measures exist? | no | Probability | Possible |
| Impact | Marginal | Incidents | 1 | Last audit | Impact | Considerable | |
Reported incidents
| Incident page | Date | Incident Name | Incident Type | Closed? |
|---|---|---|---|---|
| Lost laptop | 2021-12-02 | Lost laptop | Asset Data protection | No |
Risk description
The company generally provides employees with a laptop and other mobile devices as standard equipment. Since these are also used in the home office and at customer appointments, there is a risk of loss outside the office. The main risk here is the loss of data, both internal and customer data.
Risk treatment considerations
The following considerations were included in the risk treatment:
- Loss of a device in public transport or other public places (restaurant, hotel, etc.)
- Statutory data protection requirements
- Data classification (for data protection risks): public, internal, confidential, strictly confidential
- Replacement costs
Risk treatment plan
The purpose of a risk management plan is to show: (1) what actions are planned, (2) how they will be implemented, and (3) whether they have already been implemented. It is important that the implementation of the plan and the state of planning and implementation of the plan are understood by all concerned. It should also be possible at any time to track the progress towards the plan.
Technical measures
- All mobile devices are password-protected (only strong passwords are technically possible) and can be locked "remotely". (implemented)
- All devices are physically marked with stickers and provided with a telephone number (implemented)
- Passwords are generally not saved directly, but via the central password manager Bitwarden. (implemented)
Organisational measures
- All employees complete an annual training course on data protection. The topic of data loss is dealt with here. (implemented)
- In all cases of loss, the internal and external reporting requirements are checked and applied in accordance with the guidelines. (implemented)
