You do not have permission to edit this page, for the following reason: The action you have requested is limited to users in one of the groups: Users, editor. ● ● ● Risk matrix Impact → Negligible (A) Marginal (B) Considerable (C) Critical (D) Catastrophic (E) Consequence Environment (IE) Slight effect Minor effect Localized effect Major effect Massive effect Asset (IA) Slight damage Minor damage Medium damage Major damage Extensive damage Health (IH) Slight physical or mental harm Minor physical or mental harm Major physical or mental harm Single fatality Multiple fatalities Business continuity (IB) Minor visible or barely recognizable disruption of service Recognizable temporary disruption of service Minor functional (permanent) disruption of service Major functional (permanent) disruption of service Complete outage of service Data protection (ID) No data loss / no data disclosure Loss of rebuildable secondary data, disclosure of public data Loss of easily recoverable data, disclosure of internal data Loss of recoverable data, disclosure of some protected data Irrecoverable data loss, full disclosure of protected data ↓ Probability(within 5yrs) Certain (5)81-100% A5 B5 C5 D5 E5 Likely (4)61-80% A4 B4 C4 D4 E4 Possible (3)41-60% A3 B3 C3 D3 E3 Unlikely (2)21-40% A2 B2 C2 D2 E2 Improbable (1)0-20% A1 B1 C1 D1 E1 ID: Discovered on: Risk name: Mobile devices Risk domain: External Risk affects: AssetBusiness continuityData protectionEnvironmentHealth Owner: Starting factor: A1A2A3A4A5B1B2B3B4B5C1C2C3C4C5D1D2D3D4D5E1E2E3E4E5 Mitigation: Measures exist Last audit date: Mitigated factor: A1A2A3A4A5B1B2B3B4B5C1C2C3C4C5D1D2D3D4D5E1E2E3E4E5 GDPR TOMs: ==Risk description== The company generally provides employees with a laptop and other mobile devices as standard equipment. Since these are also used in the home office and at customer appointments, there is a risk of loss outside the office. The main risk here is the loss of data, both internal and customer data. ==Risk treatment considerations== The following considerations were included in the risk treatment: * Loss of a device in public transport or other public places (restaurant, hotel, etc.) * Statutory data protection requirements * Data classification (for data protection risks): public, internal, confidential, strictly confidential * Replacement costs ==Risk treatment plan== The purpose of a risk management plan is to show: (1) what actions are planned, (2) how they will be implemented, and (3) whether they have already been implemented. It is important that the implementation of the plan and the state of planning and implementation of the plan are understood by all concerned. It should also be possible at any time to track the progress towards the plan. === Technical measures === * All mobile devices are password-protected (only strong passwords are technically possible) and can be locked "remotely". (implemented) * All devices are physically marked with stickers and provided with a telephone number (implemented) * Passwords are generally not saved directly, but via the central password manager Bitwarden. (implemented) === Organisational measures === * All employees complete an annual training course on data protection. The topic of data loss is dealt with here. (implemented) * In all cases of loss, the internal and external reporting requirements are checked and applied in accordance with the guidelines. (implemented) Save page Cancel
