Overview

An effective risk management process is an important component of a successful information security program. Risk management is the ongoing process of identifying, assessing, and responding to IT and security risks by taking steps to reduce risk to an acceptable level. This guideline provides a foundation for an effective risk management program, containing both the definitions and the practical guidance necessary for assessing and mitigating risks identified within Roboto Studio.

1.0 Purpose

The objective of the risk management process is to identify, assess, and treat the risks to which Roboto Studio’s information is exposed. The purpose of this guideline is to help Roboto Studio carry out an effective risk assessment and risk treatment keeping in mind the following objectives:

• Identify the risks that could cause the loss of confidentiality, integrity and/or availability of the information.
• Identify the risk owners.
• Define criteria for assessing the impact and likelihood of the risk.
• Define criteria for accepting risks or link mitigating factors and action items.

2.0 Scope

This methodology document applies to all operations, products, services, information assets, and information systems that are owned and operated by Roboto Studio, including (but not limited to) applications, generative AI prompt, databases, servers and networks, and any process or procedure by which these systems are administered and/or maintained.

3.0 Definitions

3.1 Risk

Risk is a function of the likelihood of a given threat source exercising a particular potential vulnerability and the resulting impact of that adverse event on the organization.

3.2 Acceptable Risk

Acceptable risk is the risk level that the management is prepared to accept as a business risk.

3.3 Risk Assessment

This is a process to identify, analyze and prioritize the risks to the confidentiality, integrity or availability of their data or information systems based on the likelihood of the event and the level of impact it would have on the business.

3.4 Risk Management

The total process of identifying, controlling and mitigating information security-related risks. It includes risk assessment, cost-benefit analysis, selection, implementation, test and security evaluation of safeguards.

3.5 Threat

The potential for a threat source to exercise either accidentally trigger or intentionally exploit a specific vulnerability.

3.6 Vulnerability

A weakness that could permit a threat to compromise the security of information assets.

3.7 Likelihood

How often the risk event might happen (e.g., per procedure/episode or within a specified timeframe).

3.8 Risk Rating

A measurement of the risk useful for assessing the priority for control measures to treat different risks.

3.9 Inherent Risk

The likelihood of an impact occurring when a threat compromises an unprotected asset. The current risk as it appears to the risk assessor before applying any control measures.

3.10 Residual Risks

The risk that remains after a safeguard is applied. Residual risk does not take into account potential negative impacts to the organization when safeguards are applied.

3.11 Risk Owner

A risk owner is an accountable point of contact for an enterprise risk at the senior leadership level, coordinating efforts to mitigate and manage the risk with various individuals who own parts of the risk.

3.12 Impact

Impact (or consequence) refers to the extent to which a risk event might affect the organization.

4.0 Criteria for Performing Risk Assessments

Risk assessments must be conducted across the whole organization covering all key business processes. Such assessments are required to be performed while building Roboto Studio’s information security management system to identify risks and threats that could emerge from the processes, the people, or the information systems in place. In addition, risk assessments must be reviewed and performed:

• Before new processes or activities are introduced.
• Before significant changes are introduced to existing processes, activities or products.
• For any changes in legislation, regulations or contractual obligations.
• For any changes in the business model or significant changes in organizational structure.
• For any changes in suppliers.
• For any major technological changes.
• Following an incident that has significantly impacted the organization and its customer(s).
• Following results from internal audit activities (if required).

5.0 Risk Assessment Process

Roboto Studio’s risk assessment process involves the following activities:

5.1 Define the Scope

The purpose of this phase of the process is to identify what, why, where and how events might impact the achievement of Roboto Studio’s information security objectives.

5.2 Identify Risks

For the identified strategic objectives, Roboto Studio should identify the risks that may impact the achievement of these objectives.

5.3 Assess Risks

Assessing risks consists of assigning values to each risk using the defined criteria.

5.3.1 Assess Inherent Risk

Roboto Studio is required to assess the inherent risk level by evaluating the likelihood and impact of a risk if it were to occur in the absence of controls.

5.3.2 Determine Evaluation Criteria

When evaluating risks, the organization must consider risk levels under the same understanding to avoid inconsistent results.

5.3.3 Determine Impact Value

Roboto Studio must determine the impact ratings based on financial, reputational, and operational impacts.

5.3.4 Determine Likelihood

Roboto Studio's likelihood is expressed using qualitative terms (high, medium or low) as a frequency.

5.3.5 Risk Rating

A risk rating is a function of the value assessed for identified IT and security risks by determining the impact and likelihood.

5.4 Choose Risk Treatment

Risk treatment recommendations are a critical part of risk assessment to ensure that the organization has developed a plan for addressing risks without creating other risks.

5.4.1 Identify Security Controls (Choose Mitigating Controls)

Mitigating controls are designed to help reduce risk by avoiding, detecting, or correcting the things that create risk.

5.4.2 Residual Risks and Action Items

Once Roboto Studio has identified risks and applied security safeguards as part of mitigating controls to treat the unacceptable risks, the next step is to evaluate the residual risk.

6.0 Monitor and Review

The risk management process should be iterative and the subject of a structured monitoring and review process. The process needs to be monitored and reviewed on an ongoing basis by management and respective risk owners. Security safeguards must be reviewed or adjusted accordingly.