I
I
IllumiDesk
Search…
Security and Compliance
Powered By GitBook
RM.1.04 - Service Risk Rating Assignment

Control Statement

Risk management activities are prioritized based on an assigned service risk rating as defined in the risk management policy.

Context

The purpose of this control is to prioritize security resources and efforts to the services that benefit the most from them. By prioritizing services based on risk rating, we can allocate time and resource to the places that would most benefit from them.

Scope

This control applies to all systems within our production environment. The production environment includes all endpoints and cloud assets used in hosting IllumiDesk.com and its subdomains. This may include third-party systems that support the business of IllumiDesk.com.

Ownership

    Control Owner: Corporate Compliance
    Process owner(s):
      IllumiDesk Service Owners
      Data Protection Officers
      Corporate Compliance

Additional control information and project tracking

Non-public information relating to this security control as well as links to the work associated with various phases of project work can be found in the Service Risk Rating Assignment control issue.
Examples of evidence an auditor might request to satisfy this control:
    A copy of the Data Privacy Impact Assessment (DPIA) process, which prescribes the determination of a service risk rating
    Sample of completed service risk assessments

Framework Mapping

    SOC2 CC
      CC1.2
      CC3.2
      CC3.4
      CC4.1
      CC4.2
      CC5.1
      CC5.2
Last modified 1yr ago