Risk assessment

What the baseline asks

Put in place and keep up a process for assessing risk that identifies what could disrupt the organization's prioritized activities and the resources those activities need, analyses and evaluates those risks, and decides which ones need treatment.

What it means when the service runs in the cloud

Risk assessment for cloud use must include concentration: shared providers, shared regions, shared identity providers and shared networks. Individually resilient services can still fail together.

Evidence an auditor or a customer asks for

• Documented risk assessment process
• Risk register scoped to prioritized activities and their required resources
• Analysis and evaluation records with the criteria applied
• Treatment decisions recorded with rationale, including acceptance

Common gaps in a cloud estate

• Risk register covering the enterprise generally rather than the prioritized activities specifically
• Evaluation criteria undefined, so treatment decisions are unreviewable
• Resource level risks such as single site or single supplier concentration not surfaced
• Accepted risks recorded without an acceptance authority

Done well, what the file shows

Done well, this clause leaves a documented risk assessment process that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Identify any two critical services that share a provider, region or identity path.