Risk Treatment Plan
Overzicht van alle 44 gedocumenteerde risico's in het Harborn ISMS. Gesorteerd op behandeltype (Reduceren/Mitigeren/Vermijden eerst, dan Accepteren), daarna op risico-ID.
| ID | Naam | Behandeling | Kans | Impact | Blootstelling | Rest |
|---|---|---|---|---|---|---|
| 2023-20 | Disgruntled employee destroys or manipulates information | Reduceren | Laag | Hoog | Midden | Laag |
| 2025-02 | AI-generated phishing & deepfake attacks | Reduceren | Laag | Hoog | Hoog | Laag |
| 2025-03 | Cloud or deployment misconfiguration | Reduceren | Laag | Hoog | Hoog | Laag |
| 2023-01 | Mobile device lost | Accepteren | Laag | Laag | Laag | Laag |
| 2023-02 | Security flaw introduced by developer or engineer | Accepteren | Laag | Hoog | Midden | Laag |
| 2023-03 | Guest access to network | Accepteren | Midden | Laag | Laag | Laag |
| 2023-04 | Phishing and spoofing | Accepteren | Laag | Hoog | Midden | Laag |
| 2023-05 | Security vulnerability in underlying technology is exploited | Accepteren | Laag | Hoog | Midden | Laag |
| 2023-06 | Account sharing | Accepteren | Laag | Hoog | Midden | Laag |
| 2023-07 | Confidential information is leaked by employee | Accepteren | Laag | Hoog | Midden | Laag |
| 2023-08 | Insufficient control of suppliers | Accepteren | Midden | Midden | Midden | Laag |
| 2023-09 | Insufficient logging | Accepteren | Laag | Midden | Midden | Laag |
| 2023-10 | Data breach goes unnoticed | Accepteren | Laag | Midden | Midden | Laag |
| 2023-11 | Loss of cryptographic keys | Accepteren | Laag | Hoog | Midden | Laag |
| 2023-12 | Assets are not returned | Accepteren | Laag | Midden | Midden | Laag |
| 2023-13 | Retention periods are not met | Accepteren | Midden | Midden | Midden | Laag |
| 2023-14 | Inadvertent installation of malware | Accepteren | Midden | Midden | Midden | Laag |
| 2023-15 | Usage of shadow IT | Accepteren | Midden | Midden | Midden | Laag |
| 2023-16 | No back-up of critical functions or knowledge | Accepteren | Laag | Midden | Laag | Laag |
| 2023-17 | Unclear requirements from customer | Accepteren | Midden | Midden | Midden | Laag |
| 2023-18 | Improper separation of DTAP environments | Accepteren | Laag | Hoog | Midden | Laag |
| 2023-19 | Improper treatment of information | Accepteren | Midden | Midden | Midden | Laag |
| 2023-21 | Changes to organization, software or systems are performed uncontrolled | Accepteren | Midden | Midden | Midden | Laag |
| 2023-22 | Data leak or installation of malware at repair shop | Accepteren | Laag | Hoog | Midden | Laag |
| 2023-23 | Customers send confidential data by email or post | Accepteren | Midden | Midden | Midden | Laag |
| 2023-24 | Leaking confidential information during testing/demo | Accepteren | Midden | Midden | Midden | Laag |
| 2023-25 | Cloud provider outage | Accepteren | Laag | Hoog | Midden | Laag |
| 2023-26 | Domain names or DNS are hijacked | Accepteren | Laag | Hoog | Midden | Laag |
| 2023-27 | Office inaccessible | Accepteren | Laag | Laag | Laag | Laag |
| 2023-28 | Improper configuration/hardening | Accepteren | Laag | Hoog | Midden | Laag |
| 2023-29 | Usage of weak passwords | Accepteren | Laag | Hoog | Midden | Laag |
| 2023-30 | Uncontrolled installation of software | Accepteren | Midden | Midden | Midden | Laag |
| 2023-31 | Improper handling of information security incidents | Accepteren | Midden | Midden | Midden | Laag |
| 2023-32 | Unwanted access to confidential information in working areas | Accepteren | Laag | Midden | Midden | Laag |
| 2023-33 | Requirements for business continuity unknown | Accepteren | Laag | Hoog | Midden | Laag |
| 2023-34 | Improper maintenance of equipment | Accepteren | Laag | Midden | Midden | Laag |
| 2023-35 | External people have access to information (systems) | Accepteren | Midden | Midden | Midden | Laag |
| 2024-01 | Unauthorized Use of Generative AI | Accepteren | Hoog | Midden | Midden | Laag |
| 2025-01 | Departure of key figures | Accepteren | Midden | Midden | Midden | Laag |
| 2025-04 | Scrummate lacks Data Processing Agreement | Accepteren | Midden | Midden | Midden | Midden |
| 2025-05 | No control over illegal software | Accepteren | Midden | Hoog | — | Midden |
| 2025-06 | Remote wipe not possible on laptops | Accepteren | Laag | Hoog | Hoog | Midden |
| 2025-07 | Network traffic is not monitored within the office | Accepteren | Midden | Midden | Midden | Midden |
| 2025-08 | No web filtering in the office | Accepteren | Midden | Midden | Midden | Midden |