Risk Management Policy

Purpose of Policy#

This policy informs all DefectDojo employees and external parties with access to DefectDojo equipment, systems, or networks (DefectDojo Staff) of their obligations regarding the risk management of all systems, networks, IT assets, and licensed software, owned, operated, or used by DefectDojo.

Scope#

Applies to risk and risk management as it relates to information security and the confidentiality, integrity, and availability of company-owned, processed, stored, and transmitted information.

Policy Compliance#

Compliance Measurement#

The Information Security Management team will verify compliance through business tool reports, internal and external audits, and feedback to the document owner.

Exceptions#

Any exceptions must be reviewed and approved in advance by the Management Review Team.

Non-Compliance#

DefectDojo Staff found in violation of this policy may be subject to disciplinary action, up to and including termination of employment.

Continual Improvement#

The policy is reviewed and updated as part of the continual improvement process.

Requirements#

Principle#

DefectDojo’s information security management is based on appropriate and adequate risk management practices.

What is Risk Management#

• Risk: The threat or possibility that an action or event will affect DefectDojo’s ability to achieve objectives.
• Risk Management: Systematic application of principles and processes to identify, assess, and respond to risks associated with DefectDojo’s activities.

Risk Appetite#

DefectDojo maintains a Moderate Risk Appetite, mitigating risks cost-effectively while allowing some acceptance based on business needs.

Low-Risk Appetite#

Risks that shall not be accepted include:

• Unauthorized access, use, or release of personally identifiable or sensitive data.
• Noncompliance with contractual obligations, laws, regulations, policies, or procedures.
• Lack of resiliency against cybersecurity threats.

Moderate Risk Appetite#

Risks that may be mitigated proportionately and cost-effectively include:

• Alignment of enterprise information systems, data, and business practices.
• Ability to meet user demands and support a mobile workforce.
• Technology infrastructure performance (stability, reliability, capacity, redundancy).
• Business resiliency planning and execution.

Risk Identification and Assessment#

• Conducted at least every 12 months or following significant changes.
• Assessed for:
  • Processing, storing, or transmitting confidential, personal, or cardholder information.
  • Third-party suppliers handling sensitive data.
  • New systems or significant changes.

Risk Register#

All identified risks are recorded in the DefectDojo risk register.

Risk Reporting#

• Reviewed at Management Review Team meetings.
• Significant risks (score > 8 or severe) reported to Senior Management.
• Forms part of enterprise risk management reporting.

Risk Review#

Regular review ensures:

• Progress on risk actions.
• Effectiveness of risk mitigation.
• Management of residual risk.

Risk Treatment#

Risk Acceptance#

• Decision by departmental manager and/or Senior Management.
• Criteria for acceptance:
  • Low-risk and not cost-effective to treat.
  • Business opportunities outweigh threat/impact.
  • No feasible risk treatment exists.
  • Impact is acceptable to DefectDojo.

Risk Mitigation#

• Requires approval by the relevant manager, Management Review Team, or Senior Management.
• Assign responsibility for implementation and management.
• Document actions in the Risk Register and review at Management Review Team meetings.

Risk Evaluation#

Evaluated on potential impact to:

• Compliance and legal obligations.
• Reputation.
• Customers.
• Business goals and objectives.
• Financial performance.

Relevant Documents#

• Risk Management Procedure