Rating of 9 or

1 = Low See greater indicates a

2 = Medium Ratings HIGH Security RISK
and require Security
Security Risk Assessment 3 = High Below Controls

without Controls
Probability of

Consequence

Risk Rating
Occurence
Process Type Asset Owner Threat Vulnerability
FACILITY and OPERATIONS

Locks/Key Control Facility (Enter Recycler Name) Theft, Property Damage, Unlocked facility, Human Error, 3 3 9
Personal Injury Unauthorized access to keys

Theft, Property Damage, Unlocked gated, Human Error,

Fences/Gates Facility (Enter Recycler Name) Personal Injury Unauthorized access to facility 3 3 9

Theft, Property Damage, Inadequate Lightning,

Security Lighting Facility (Enter Recycler Name) 3 3 9
Personal Injury Unauthorized access to facility

Theft, Property Damage,

Alarm Monitoring Facility (Enter Recycler Name) Personal Injury Unauthorized access to facility 3 3 9

Motion-Detection Theft, Property Damage,

Facility (Enter Recycler Name) Unauthorized access to facility 3 3 9
Devices Personal Injury

Video Surveillance Facility (Enter Recycler Name) Theft, Property Damage, Unauthorized access to facility 3 3 9
Personal Injury

Theft, Property Damage, Unauthorized access to specific

Access - Employees Facility (Enter Recycler Name) 3 3 9
Personal Injury areas within the facility

Access - Visitors Facility (Enter Recycler Name) Theft, Property Damage, Unauthorized access to specific 3 3 9
Personal Injury areas within the facility

Theft, Property Damage, Unauthorized access to specific

Access - Contractors Facility (Enter Recycler Name) 3 3 9
Personal Injury areas within the facility

Business - Storage in unlocked cabinet,

Storage of confidential Confidential (Enter Recycler Name) Personal (HR) , Business Human Error, Insufficieny 3 3 9
documents other Documents stolen
Documents facility security

000000643548503.xls 000000Page 1 of 3
Effective Date:
 Business -
Storage of confidential Confidential Personal, Business other Storage in unlocked cabinet,
Data on (Enter Recycler Name) Human Error, Insufficieny 3 3 9
data Data stolen
(Company facility security
Name) Server

Business -
Breakdown of physical No system backup taken.
assets Servers, (Enter Company Name) Server, computer, down Second server also found down 2 2 4
computers

Power supply to Business - Power outage, power No UPS available or not

Electricity/Powe (Enter Company Name) 2 2 4
equipments r failure functioning

Storage of data in the Business -

servers and computers Servers, (Enter Company Name) Damage to Servers, Damage to servers and 1 2 2
and chances of fire or computers insufficient security
computers
server failure

CUSTOMER

Storage of confidential Customer - Insufficieny facility security,

data on data bearing Confidential Customer Owned Personal, Business other Human Error, Unathorized 3 3 9
Data stolen
devices Data access

Insufficieny data sanitization

Data Sanitization of Customer - Personal, Business other procedure, Human Error,
confidential data on Confidential Customer Owned 3 3 9
Data stolen insufficient validation of data
data bearing devices Data sanitization

Insufficieny data destruction

Physical Destruction of Customer - Personal, Business other procedure, Human Error,
confidential data on Confidential Customer Owned 3 3 9
data bearing devices Data Data stolen insufficient validation of data
sanitization

Security Risk Matrix

CONFIDENTIALITY CONSEQUENCE

Consequence Rating Financial Impact Facility Customer

to organization

1 Low Low impact to facility No impact to customer

000000643548503.xls 000000Page 2 of 3
Effective Date:

2 Medium
3 High
000000643548503.xls
Effective Date:
Customer dissatisfaction
Moderate damage to facility and
leads to reduction in
organization. Reversible
business
High impact to facility or
Customer dissatisfaction
organization. Permanent
would impact large
damage to organization. Data accounts and losing
was intended for use by named
customers
individuals only.
000000Page 3 of 3