Purpose
This policy defines Carriyo's methodology for identifying, analysing, evaluating, and treating information security risks. It provides a consistent and repeatable approach to risk assessment that supports informed decision-making and ensures that risks to Carriyo's information assets are managed to acceptable levels.
Scope
This policy applies to all information security risk assessment activities within Carriyo's ISMS, including assessments of:
- Information assets, systems, and processes within the ISMS scope.
- Third-party and supply chain risks.
- Risks arising from changes to technology, operations, or the threat landscape.
- Risks identified through incidents, audits, or vulnerability assessments.
Policy Statements
Risk Assessment Approach
- Carriyo uses a qualitative risk assessment methodology based on the assessment of likelihood and impact for each identified risk.
- Risk assessments are conducted at least annually for the full ISMS scope and on an ad-hoc basis when triggered by significant changes, incidents, or new threats.
- The risk assessment process follows five phases: Context Establishment, Risk Identification, Risk Analysis, Risk Evaluation, and Risk Treatment.
Phase 1: Context Establishment
- Before conducting a risk assessment, the assessor defines the scope, boundaries, and context, including:
- The assets, processes, or systems being assessed.
- The internal and external threat landscape.
- Applicable regulatory, contractual, and business requirements.
- Existing controls already in place.
Phase 2: Risk Identification
- Risks are identified by considering threats and vulnerabilities that could affect the confidentiality, integrity, or availability of information assets within scope.
- Risk identification methods include: asset inventory review, threat intelligence analysis, vulnerability assessment results, incident history analysis, interviews with asset owners, and industry benchmarks.
- Each identified risk is documented in the Risk Register with: a unique risk ID, description, affected asset(s), threat source, vulnerability exploited, and the existing controls.
Phase 3: Risk Analysis
Risks are analysed by assessing their likelihood and impact using the following scales:
Likelihood Scale:
| Level | Rating | Description |
|---|---|---|
| 1 | Rare | May occur only in exceptional circumstances (<1% annual probability) |
| 2 | Unlikely | Could occur but is not expected (1-10% annual probability) |
| 3 | Possible | Might occur at some time (10-50% annual probability) |
| 4 | Likely | Will probably occur in most circumstances (50-90% annual probability) |
| 5 | Almost Certain | Expected to occur (>90% annual probability) |
Impact Scale:
| Level | Rating | Description |
|---|---|---|
| 1 | Negligible | Minimal impact; no disruption to services; no customer impact |
| 2 | Minor | Brief service degradation; minor customer inconvenience; easily remediated |
| 3 | Moderate | Noticeable service disruption; limited data exposure; requires significant effort to remediate |
| 4 | Major | Extended service outage; significant data breach; regulatory notification required; material financial impact |
| 5 | Severe | Complete service failure; large-scale data breach; severe regulatory penalties; existential business threat |
Risk Score: Likelihood x Impact (range: 1-25)
Phase 4: Risk Evaluation
Risks are evaluated against the following risk acceptance criteria:
| Risk Score | Risk Level | Action Required |
|---|---|---|
| 1-4 | Low | Accept — monitor and review at next scheduled assessment |
| 5-9 | Medium | Treat — implement additional controls within 6 months |
| 10-15 | High | Treat — implement additional controls within 3 months; escalate to CISO |
| 16-25 | Critical | Treat immediately — escalate to CISO and executive management; implement controls within 30 days |
Phase 5: Risk Treatment
For each risk that requires treatment, one of the following options is selected:
- Mitigate: Implement controls to reduce the likelihood or impact of the risk.
- Transfer: Transfer the risk to a third party (e.g., through insurance or contractual arrangements).
- Avoid: Eliminate the risk by removing the activity or asset that gives rise to it.
- Accept: Formally accept the residual risk with CISO approval (only for risks within the Low threshold or where treatment is not cost-effective).
Risk treatment decisions are documented in the Risk Treatment Plan (CAR-ISMS-REC-001) with: the selected treatment option, specific controls or actions, responsible owner, target completion date, and expected residual risk after treatment.
Risk Register
- The Risk Register is the central record of all identified risks and their current status.
- The Risk Register is maintained by the security team and reviewed at least quarterly.
- Each entry includes: risk ID, description, affected assets, likelihood, impact, risk score, current controls, treatment decision, treatment status, risk owner, and date of last review.
Risk Acceptance
- Residual risks (after treatment) must be formally accepted by the CISO.
- Risk acceptance decisions are documented in the Risk Register with the acceptance date and the CISO's acknowledgement.
- Accepted risks are reviewed at least annually to confirm that the acceptance remains appropriate.
Roles and Responsibilities
| Role | Responsibility |
|---|---|
| Security Team | Facilitate risk assessments; maintain Risk Register; coordinate risk treatment; report to CISO |
| Asset Owners | Participate in risk identification; implement assigned risk treatment actions; monitor risks for their assets |
| CISO | Approve risk acceptance; review high and critical risks; allocate resources for risk treatment; approve this policy |
| Executive Management | Receive risk reports; support resource allocation for critical risk treatment |
Compliance and Enforcement
Compliance with this policy is verified through the maintenance of the Risk Register, completion of scheduled risk assessments, and progress on risk treatment actions. Failure to conduct required risk assessments or implement agreed treatment actions is escalated to the CISO. The risk assessment methodology is reviewed annually and updated as necessary to reflect evolving best practices and organisational changes.