The Security Risk Assessment: A Data-Driven Methodology
At Outbox, the security risk assessment is far more than a “check-the-box” compliance exercise; it is a fundamental business enabler. To fulfill our mission to “Challenge and Innovate,” we must move beyond static checklists toward a data-driven methodology that provides an objective view of our risk landscape.
By meticulously examining how we interact with clients and consumers, we challenge ourselves to improve the security experience at every stage. This approach is rooted in our core values: we empower responsible people who are held accountable for results, and we maintain a commitment to excellence in every undertaking.
The ISMS Framework: Aligning with Clause 6.1.2
The Outbox risk assessment process is explicitly designed to align with ISO/IEC 27001:2022 Clause 6.1.2. This alignment provides the formal structure for establishing, implementing, and maintaining our Information Security Management System (ISMS), ensuring the confidentiality, integrity, and availability (CIA) of all information processing facilities.
In accordance with our Background Screening and Access Control Policies, this process is foundational to establishing trust and integrity across the organization. By identifying and treating risks systematically, we ensure that access is granted solely based on business need.
Step 1: Context and Asset Identification
The first step of the assessment is identifying exactly what requires protection. Per the Asset Management Policy, Outbox maintains a comprehensive inventory of all facilities and resources that store, process, or transmit classified information.
Essential Asset Data Points:
- Asset Type: (e.g., Device, software, cloud resource).
- Owner: The specific individual or group accountable for the asset.
- Location: Physical or virtual placement (e.g., OVH, AWS).
- Classification: Sensitivity level of the data.
- Status: Current lifecycle stage (Active, Inactive, Disposed).
Data Classification Levels
The Data Management Policy defines three classes of data used to determine risk impact:
- Confidential: Highly sensitive data (PII, Customer Data, Payment Card Data, Source Code, Secrets).
- Restricted: Proprietary internal information (Policies, contracts, meeting minutes).
- Public: Documents intended for public distribution (Marketing materials, release notes).
Step 2: Threat and Vulnerability Analysis
The second step involves identifying threats that could exploit vulnerabilities. This process relies on technical data and intelligence rather than intuition. Threats are derived from Targeted Risk Analysis (TRA) and industry intelligence.
Key Examples:
- Breakdown of Network Segmentation.
- Lateral Movement within cloud environments.
- E-commerce skimming code targeting payment pages.
Outbox utilizes tools such as Tenable for external scans and monitors vendor alerts and public databases (NIST, SANS) to identify misconfigurations proactively.
Step 3: The 1-5 Scoring System
Outbox utilizes a quantitative 1–5 scoring system to prioritize risks using the formula: Risk = Likelihood x Impact.
The Likelihood Scale (1-5)
Measures the probability of a threat occurring, considering known vulnerabilities, transaction volumes, and potential “Configuration Drift.”
The Impact Scale (1-5)
Measures potential damage, linked to our BCDR Plan and Data Management Policy. Any asset ranked as “1” in the BCDR Appendix A automatically triggers a maximum impact score of 5.
Risk Matrix (5×5)
| Impact \ Likelihood | 1 (Rare) | 2 (Unlikely) | 3 (Possible) | 4 (Likely) | 5 (Certain) |
|---|---|---|---|---|---|
| 5 (Catastrophic) | 5 | 10 | 15 | 20 | 25 |
| 4 (Major) | 4 | 8 | 12 | 16 | 20 |
| 3 (Moderate) | 3 | 6 | 9 | 12 | 15 |
| 2 (Minor) | 2 | 4 | 6 | 8 | 10 |
| 1 (Insignificant) | 1 | 2 | 3 | 4 | 5 |
Step 4: Risk Treatment and Remediation
The risk score dictates the urgency of remediation, forming a contractual and regulatory obligation under ISO 27001 Annex A.8.8 and PCI DSS.
| Determined Severity | Remediation Timeline |
|---|---|
| Critical | 10 Days |
| High | 30 Days |
| Medium | 60 Days |
| Low | 90 Days |
| Informational | As needed |
Step 5: Ongoing Monitoring and TRA
Risk management is a continuous lifecycle. To validate effectiveness, we rely on Internal Audits (ISO 27001 Clause 9.2) to ensure controls are operating as intended. Assessments are conducted annually or upon significant changes to network architecture or organizational structure.
Conclusion: Building a Culture of Security
By adopting this rigorous, data-driven methodology, Outbox achieves more than regulatory compliance; we build a proactive defense that safeguards customer trust. This framework integrates security into the fabric of our innovation, ensuring that every team member is responsible for the protection of our community.
Get Your Free Security Readiness Assessment
Map your controls, identify compliance gaps, and secure your systems before the audit.