Risk assessment

// REQUIREMENTS

// INTENT

Assess risk to the protected data periodically, scan for vulnerabilities on a cycle, and fix what the scans find inside a defined window.

// WHAT A FIRST ASSESSMENT FINDS

A penetration test bought before a single vulnerability scan was run, and a report nobody actioned.

// THE WORK

Scan the enclave on a cycle with proper tools, rank the findings, fix inside a defined window, and record the next scan date. Progress is what the assessor wants to see.

// HOW WE CAN INTERPRET IT

// TEMPLATES FOR THIS FAMILY

• Policy inventory checklist