6. Planning
6.1 Actions to address risks and opportunities
Section titled “6.1 Actions to address risks and opportunities”Risk management has three steps: identify risks, assess them with fixed criteria, and treat them. Clause 8 is doing it; this page describes how.
6.1.1 Identifying risks
Section titled “6.1.1 Identifying risks”- At least twice a year the ISMS security meeting is a risk identification session: the people with security roles from each product ask what can go wrong with our information and systems.
- The same session looks for opportunities: changes that make our security or the ISMS better. Each one becomes an issue, planned like other work.
- New risks also come from incidents, audit findings, changes (see the change management policy) and new suppliers.
- Every identified risk becomes an issue linked to the ISMS risk register, using the template there.
6.1.2 Assessing risks
Section titled “6.1.2 Assessing risks”Each risk gets an impact and a likelihood, both High, Medium or Low, using the criteria below. The criterion
that applies is written in the risk issue, so a colleague assessing the same risk next year gets the same result.
Impact is judged on confidentiality, integrity and availability. The highest level whose criterion is met applies.
| Impact | Criteria |
|---|---|
| High | Personal data of 2000 or more people, or any special category personal data, is exposed or altered; loss above 5% of yearly turnover; a production product is down for more than one working day; a breach of law or contract that must be reported |
| Medium | Personal data of fewer than 2000 people or confidential business data is exposed or altered; loss between 1% and 5% of yearly turnover; a production product is down or degraded for more than one hour |
| Low | Only internal or public information is affected; loss below 1% of yearly turnover; degradation of less than one hour; recovery without customer impact |
| Likelihood | Criteria |
|---|---|
| High | Expected at least once a year, or it happened to us or a comparable company in the last year, or it needs no special access or skill |
| Medium | Expected once in one to five years, or it needs some access or skill |
| Low | Expected less than once in five years, or it needs privileged access combined with another failure |
The score follows from the matrix:
| Impact \ Likelihood | Low | Medium | High |
|---|---|---|---|
| High | Medium | High | High |
| Medium | Low | Medium | High |
| Low | Low | Low | Medium |
6.1.3 Treating risks
Section titled “6.1.3 Treating risks”- Every risk has an owner and a treatment: mitigate, avoid, transfer, or accept. The owner approves the treatment plan.
- A
Highrisk gets a treatment plan within one month and its actions in the next sprint. AMediumrisk gets a plan within three months. ALowrisk may be accepted by its owner, with the reason in the issue. - The actions are a task list in the risk issue and are planned in sprints like any other work.
- The treatment names the Annex A controls it relies on. Every applicable control in the Statement of Applicability links to at least one risk, so no control is missing.
- A risk issue is closed when its actions are done and the owner accepts the remaining risk.
6.2 Information security objectives
Section titled “6.2 Information security objectives”The information security policy states what we want to achieve. These objectives make that measurable. Each objective has an issue linked to ISMS objectives where its measurements are recorded.
| Objective | KPI | Target | Owner |
|---|---|---|---|
| Keep customer data confidential | Personal data breaches that must be reported to the Autoriteit Persoonsgegevens | 0 per year | Information Security Officer |
| Fix vulnerabilities quickly | Time from a known critical or high vulnerability in production code or images to the fix | Critical within 7 days, high within 30 days | Project lead |
| Keep products available | Monthly availability of each production product | 99.9% | Infrastructure |
| Run the ISMS as planned | Recurring ISMS tasks completed in the period they are due | 100% | Information Security Officer |
| Keep everyone aware | Employees who attended a security awareness moment in the last 12 months | 100% | Information Security Officer |
For each objective the issue states what is done, the resources it needs, who is responsible, when it is completed, and how the result is evaluated. The ISMS security meeting reviews the KPIs; the yearly management review sets the objectives for the next year.
6.3 Planning of changes
Section titled “6.3 Planning of changes”Changes to the ISMS itself, such as a new product in scope, a new policy, or a change of roles, follow the change management policy as a big change.