Item 26 - Agreement with Allied Network Solutions, Inc. for Adobe Software and Subscription

Home Browse Search

Security Policies and Procedures A. Risk reviews The job of reviewing risks and setting requirements for controls is the ISO's. Risks should be reviewed or assessed when: 1. Developing or deploying new applications, systems, networks or software 2. When significant changes are made to that same list 3. When business processes change 4. When Virtru enters a new geographical area of business S. When Virtru enters a new line of business 6. When incidents occur or new risks emerge 7. When new regulations or standards are set B. Risk management Risks may be accepted, avoided or mitigated. Accepting the risk is appropriate when the cost of avoiding or mitigating the risk is greater than the expected loss. The losses considered should include the less tangible items such as Virtru's reputation, loss of market share and loss of public trust in Virtru. Acceptance of a risk requires complete documentation of the risk analysis and approval by the information owner. Avoiding the risk is appropriate when the cost of insurance is less than the cost of incremental controls. However, basic controls must always be in place. Mitigating the risk is appropriate in most situations. These situations are those where compensating controls are possible, cost-effective and manageable. These mitigating controls may include: 1. Increasing a protection to a level higher than what is listed in this document 2. Improving oversight or monitoring of the risk to limit impact and minimize response time 3. Limiting transactions or other events to minimize the possible impact of the risk event The method chosen for managing the risk (acceptance, avoidance, mitigation) must match the business value and costs involved and must be approved by the information owner. For further detail, see the Risk Management Policy and the Disaster Recovery Plan. Rev.2015.8.6 26