Skip to content

Information Security Risk Management Policy

Organization: Cloudnaut Technologies LLP
Classification: Internal
Document status: Effective
Version: 1.0
Owner: Management / Security Owner
Effective date: 2026-10-15
Review cycle: Annual; interim revision upon material change to services or threat landscape

Document control

Role Name
Prepared by Management / Security Owner (Cloudnaut)
Reviewed by Sandeep AC
Approved by Sandeep AC

Revision history

Version Date Summary Reviewed by Approved by
0.1 2026-10-15 Initial draft. Sandeep AC —
1.0 2026-10-15 Initial effective release. Sandeep AC Sandeep AC

Purpose

This policy defines how Cloudnaut identifies, assesses, treats, and monitors information security risks to its own operations and to the customer engagements it delivers.

Scope

  • Organizational risk: risks to Cloudnaut’s people, endpoints, corporate systems, suppliers, and services.
  • Engagement risk: risks arising from Cloudnaut’s work in or for a customer environment (for example access held, data handled, code and infrastructure delivered). Risks to the customer’s own infrastructure that are outside Cloudnaut’s responsibility are reported to the customer, not owned by Cloudnaut.
  • Change risk in software delivery is handled by the risk tiers in the Secure SDLC Policy and is not duplicated here.

Roles and responsibilities

Role Responsibilities
Management Sets risk appetite; approves treatment plans; formally accepts residual High risks.
Security Owner Runs the risk process; maintains the risk register; reports to management.
Risk owner Named individual accountable for treating a specific risk.
Engagement Lead Identifies engagement risks at start and on material change; raises customer-owned risks to the customer.

Policy

When risk is assessed

  • At least annually for organizational risk.
  • At the start of each engagement and on material change in scope, access, or data handled.
  • When onboarding a new critical supplier or tool (see Third-Party and Supplier Security Policy).
  • After Severity 1 or 2 incidents.

Method

  1. Identify the asset or activity, the threat, and the vulnerability.
  2. Assess likelihood (1 Rare – 5 Almost certain) and impact (1 Negligible – 5 Severe) considering existing controls. Risk score = likelihood × impact.
  3. Rate: 1–4 Low, 5–9 Medium, 10–16 High, 20–25 Critical.
  4. Treat: mitigate, avoid, transfer (for example contract or insurance), or accept.
  5. Accept: residual Low and Medium risks may be accepted by the risk owner; residual High and Critical risks require written management acceptance with a review date. Risks affecting a customer are not accepted on the customer’s behalf.
  6. Monitor: treatment actions are tracked to completion; the register is reviewed at least quarterly by the Security Owner and annually at management review.

Risk register

Each entry records: ID, description, asset/engagement, owner, likelihood, impact, score, existing controls, treatment, target date, residual score, acceptance (who/when), and status. The register is held internally and is not published.

Exceptions

None. Where the method cannot be applied, the Security Owner records the reason and the alternative assessment used.

Records

Risk register, assessment records, treatment tracking, management acceptance records, and management review minutes.