Skip to content

Risk Assessment and Treatment Process

Purpose. Defines how Soon identifies, analyses, evaluates and treats information security risks (ISO/IEC 27001:2022 6.1.2, 6.1.3, 8.2, 8.3). It is the methodology; its output is the Risk Assessment Report (ISMS-DOC-06-3) and the Risk Treatment Plan (ISMS-DOC-06-4), which together justify the Statement of Applicability.

1. Scope & inputs

Risk assessment covers all assets in the Information Asset Inventory within the ISMS scope. Inputs: the asset inventory, the context/issues (SWOT/PESTLE), interested-party requirements, legal/regulatory obligations (GDPR, NIS2), threat intelligence, and incident history.

2. Approach

Soon uses a combined asset-based and scenario-based method, kept deliberately lean for a small team:

  1. Identify risks — for each asset (or asset group) and key threat scenario, identify how Confidentiality, Integrity or Availability could be compromised (threat × vulnerability).
  2. Assign a risk owner — the person accountable for the risk decision.
  3. Analyse — rate Likelihood and Impact (scales below); Risk = L × I.
  4. Evaluate — compare the score to the acceptance criteria and risk appetite.
  5. Treat — choose a treatment option; identify the Annex A controls; record the target residual risk.
  6. Record — in the Risk Assessment Report; track actions in the Risk Treatment Plan.

3. Likelihood scale

Score Level Meaning
1 Rare Not expected to occur (≈ once in 5+ years)
2 Unlikely Could occur occasionally (≈ once in 2–5 years)
3 Possible Might well occur (≈ yearly)
4 Likely Expected to occur (≈ several times a year)
5 Almost certain Expected frequently / already occurring

4. Impact scale

Score Level Indicative impact (any one dimension qualifies)
1 Insignificant Negligible effect; no data/PII exposure; no customer impact
2 Minor Minor disruption; internal only; easily recovered
3 Moderate Limited PII/customer-data exposure; short outage; minor SLA/contract impact
4 Major Significant PII breach; notable outage; GDPR notification; contractual penalties; reputational harm
5 Severe Large-scale data breach; prolonged outage; major regulatory fines; serious reputational/financial damage

5. Risk rating & acceptance criteria

Risk = Likelihood × Impact (1–25).

Score Level Action (Moderate risk appetite)
1–4 🟢 Low Acceptable — retain; no treatment required (monitor)
5–9 🟡 Medium Treat where proportionate; risk owner decides; document the decision
10–25 🔴 High Must be treated — not acceptable to retain, especially where customer data, GDPR compliance or availability is affected

This reflects Soon's Moderate risk appetite (per the Context & Scope): pragmatic acceptance of low risk, active treatment of anything threatening customer data, compliance, continuity or reputation.

6. Risk treatment options

Option When used
Modify (reduce) Apply/strengthen Annex A controls to lower likelihood or impact (the default)
Retain (accept) Risk is within appetite; documented acceptance by the risk owner
Avoid Stop the activity causing the risk
Share (transfer) Insurance, or contractual transfer to a supplier (e.g. PCI scope to Stripe) — noting accountability remains with Soon

After treatment, the residual risk is re-rated. Residual risk above appetite requires explicit risk-owner acceptance and sign-off at management review.

7. Roles

  • Risk owners — accountable for individual risk decisions and treatment delivery.
  • Information Security Manager (Olaf) — maintains the process, report and treatment plan; consolidates for management review.
  • Management review — approves residual risk and the treatment plan periodically.

8. Frequency

The full risk assessment is reviewed and updated at least annually, and whenever: a significant change occurs (new product/integration, cloud change, major supplier), a significant incident happens, or the threat landscape shifts materially.

The set of Annex A controls selected to treat risks determines which controls are applicable in the SoA. The SoA is updated whenever treatment decisions change applicability.

Change log

Version Date Author Comments
0.1 2026-06-25 Andrea Cardinali / ISMS First draft — methodology, 5×5 scales, acceptance criteria aligned to Moderate appetite.