BluB0X Security Corporate Risk Assessment Policy

Overall Corporate Risk Assessment Policy

Purpose: The purpose of this policy is to establish a structured approach to identifying, evaluating, and addressing risks across all levels of the organization. This includes corporate risks, technological risks, and other potential threats that could impact our operations, reputation, or stakeholders.

Scope: This policy applies to all employees, contractors, and business units within the organization.

Policy Statement: We are committed to maintaining a robust risk assessment process that enables proactive identification and management of risks. Our approach is designed to protect the company’s assets, ensure regulatory compliance, and support our strategic objectives.

Risk Assessment Procedure:

1. Identification of Risks:
   • Each department must regularly identify potential risks that could affect their operations.
   • Risks are categorized into corporate risks (strategic, financial, operational) and technology risks (cybersecurity, data privacy, IT infrastructure).
2. Risk Scoring System:
   • Identified risks are scored based on their likelihood and potential impact using a predefined scoring matrix.
   • The scoring matrix ranges from 1 (low risk) to 5 (high risk) for both likelihood and impact.
3. Risk Review:
   • A cross-functional Risk Assessment Committee (RAC) reviews the scored risks.
   • The RAC meets quarterly to evaluate new risks and review the status of existing ones.  Additional meeting may be held if there is a time-sensitive need to perform a Risk Review.
4. Treatment/Mitigation Plans:
   • For each high-scoring risk, the relevant department must develop a treatment or mitigation plan that includes ongoing monitoring and re-evaluation.
   • Medium-scoring risk may also require ongoing monitoring if deemed necessary by the RAC.
   • Plans should outline specific actions, responsible parties, and timelines for addressing the risk.
5. Monitoring and Reporting:
   • Departments are responsible for monitoring the implementation of treatment/mitigation plans.
   • Progress reports are submitted to the RAC and included in the company’s risk register.
6. Continuous Improvement:
   • The risk assessment process is subject to ongoing review and improvement to adapt to the changing risk landscape.

Compliance: Failure to comply with this policy may result in disciplinary action, up to and including termination of employment.

Review and Approval: This policy is reviewed annually by the RAC and approved by the Board of Directors.