Mobile devices

Risk matrix
Impact →
Negligible

(A)

Marginal

(B)

Considerable

(C)

Critical

(D)

Catastrophic

(E)

Consequence Environment (IE) Slight effect Minor effect Localized effect Major effect Massive effect
Asset (IA) Slight damage Minor damage Medium damage Major damage Extensive damage
Health (IH) Slight physical or mental harm Minor physical or mental harm Major physical or mental harm Single fatality Multiple fatalities
Business continuity (IB) Minor visible or barely recognizable disruption of service Recognizable temporary disruption of service Minor functional (permanent) disruption of service Major functional (permanent) disruption of service Complete outage of service
Data protection (ID) No data loss / no data disclosure Loss of rebuildable secondary data, disclosure of public data Loss of easily recoverable data, disclosure of internal data Loss of recoverable data, disclosure of some protected data Irrecoverable data loss, full disclosure of protected data
↓ Probability
(within 5yrs)
Certain (5)
81-100%
A5 B5 C5 D5 E5
Likely (4)
61-80%
A4 B4 C4 D4 E4
Possible (3)
41-60%
A3 B3 C3 D3 E3
Unlikely (2)
21-40%
A2 B2 C2 D2 E2
Improbable (1)
0-20%
A1 B1 C1 D1 E1
Mitigated risk Original risk
Factor B3 ID AS1 Affects Asset

Data protection

Factor C3
Level Low Discovered on 2021-11-26 Owner User:Parnoux Level Medium
Probability Possible Domain External Measures exist? no Probability Possible
Impact Marginal Incidents 1 Last audit Impact Considerable

Reported incidents[edit source]

Incident pageDateIncident NameIncident TypeClosed?
Lost laptop2021-12-02Lost laptopAsset
Data protection
No

Risk description[edit | edit source]

The company generally provides employees with a laptop and other mobile devices as standard equipment. Since these are also used in the home office and at customer appointments, there is a risk of loss outside the office. The main risk here is the loss of data, both internal and customer data.

Risk treatment considerations[edit | edit source]

The following considerations were included in the risk treatment:

  • Loss of a device in public transport or other public places (restaurant, hotel, etc.)
  • Statutory data protection requirements
  • Data classification (for data protection risks): public, internal, confidential, strictly confidential
  • Replacement costs

Risk treatment plan[edit | edit source]

The purpose of a risk management plan is to show: (1) what actions are planned, (2) how they will be implemented, and (3) whether they have already been implemented. It is important that the implementation of the plan and the state of planning and implementation of the plan are understood by all concerned. It should also be possible at any time to track the progress towards the plan.

Technical measures[edit | edit source]

  • All mobile devices are password-protected (only strong passwords are technically possible) and can be locked "remotely". (implemented)
  • All devices are physically marked with stickers and provided with a telephone number (implemented)
  • Passwords are generally not saved directly, but via the central password manager Bitwarden. (implemented)

Organisational measures[edit | edit source]

  • All employees complete an annual training course on data protection. The topic of data loss is dealt with here. (implemented)
  • In all cases of loss, the internal and external reporting requirements are checked and applied in accordance with the guidelines. (implemented)
No categories assignedEdit

Discussions