Risk library

Security tasks are missed or not followed up, allowing data exposure or service disruption.

Root cause: Unclear responsibilities, outdated policies, insufficient management attention or missing independent reviews.

Consequence: Security weaknesses remain unresolved, incidents recur and important business information or services are affected.

A.5.1 · A.5.2 · A.5.4 · A.5.35 · A.5.36 · A.5.37

Unmanaged devices, software or cloud services expose information or provide an entry point for attackers.

Root cause: Incomplete asset records, unclear ownership, unapproved tools or devices, or assets not returned when people leave.

Consequence: Data exposure, unnoticed vulnerabilities and loss of control over company information and equipment.

A.5.9 · A.5.10 · A.5.11 · A.5.23 · A.8.1 · A.8.19

An attacker takes over a user or service account and gains access to systems or information.

Root cause: Stolen or reused passwords, exposed API keys, weak authentication, shared accounts or poorly protected login sessions.

Consequence: Unauthorized access, stolen information, fraudulent actions or further compromise of systems.

A.5.15 · A.5.16 · A.5.17 · A.8.5

People access, change or delete information beyond what their role requires, including after they leave.

Root cause: Excessive permissions, unnecessary administrator rights, missing access reviews or delayed removal of access.

Consequence: Unauthorized disclosure or changes, fraud, data loss and disruption of critical systems.

A.5.3 · A.5.15 · A.5.16 · A.5.18 · A.6.5 · A.8.2 · A.8.3 · A.8.18

People are tricked by phishing or impersonation into sharing information, approving payments or granting access.

Root cause: Convincing fake emails, calls or websites, limited awareness and insufficient checks on unusual requests.

Consequence: Account compromise, data theft, malware infection or financial loss.

A.6.3 · A.6.8 · A.8.5 · A.8.7 · A.8.23

An employee or contractor deliberately steals information, commits fraud or damages systems using legitimate access.

Root cause: Insufficient screening, unclear confidentiality obligations, weak oversight or repeated misconduct without follow-up.

Consequence: Loss of sensitive information or intellectual property, manipulated records, financial loss and operational disruption.

A.5.3 · A.5.10 · A.6.1 · A.6.2 · A.6.4 · A.6.5 · A.6.6 · A.8.12 · A.8.15

Sensitive information is accidentally shared with, or visible to, the wrong people.

Root cause: Misdirected messages, public sharing links, unclear data classification, unsecured transfers, unattended screens or unapproved AI tools.

Consequence: Disclosure of company or personal information, customer complaints and loss of trust.

A.5.10 · A.5.12 · A.5.13 · A.5.14 · A.6.3 · A.6.6 · A.7.7 · A.8.11 · A.8.12 · A.8.24

A lost or stolen laptop, phone, document or storage device exposes company information.

Root cause: Unprotected devices or media, insecure remote working, lack of encryption or equipment left unattended outside the office.

Consequence: Unauthorized access to information, lost records, replacement costs and interrupted work.

A.5.11 · A.6.7 · A.7.9 · A.7.10 · A.8.1 · A.8.24

Unauthorized people enter offices or technical areas and access, steal or tamper with information or equipment.

Root cause: Weak door access, unmanaged visitors, missing physical monitoring or insufficient protection of secure areas and cabling.

Consequence: Data theft, equipment loss, unauthorized connections and service disruption.

A.7.1 · A.7.2 · A.7.3 · A.7.4 · A.7.6 · A.7.8 · A.7.12

Fire, water, power loss, overheating or equipment damage makes premises or IT infrastructure unavailable.

Root cause: Inadequate environmental protection, exposed equipment or cabling, unreliable utilities or missed maintenance.

Consequence: Unavailable workplaces or systems, damaged equipment, lost information and recovery costs.

A.7.5 · A.7.8 · A.7.11 · A.7.12 · A.7.13 · A.8.14

Malware or ransomware steals, corrupts or encrypts information and disrupts business operations.

Root cause: Malicious attachments or downloads, unsafe software installations, weak endpoint protection or unrestricted network access.

Consequence: Data theft, unavailable systems, extortion, lost work and costly recovery.

A.8.1 · A.8.7 · A.8.13 · A.8.19 · A.8.20 · A.8.22 · A.8.23

Attackers exploit technical vulnerabilities or insecure configurations to compromise systems and information.

Root cause: Delayed patching, unsupported software, exposed services, insecure settings or missed threat and vulnerability information.

Consequence: Unauthorized access, data theft or manipulation, and compromise spreading to other systems.

A.5.7 · A.8.8 · A.8.9 · A.8.20 · A.8.21 · A.8.22 · A.8.24

Applications or APIs expose or alter information because security weaknesses reach production.

Root cause: Missing security requirements, insecure code, weak reviews or testing, exposed test data or poorly controlled outsourced development.

Consequence: Exploitable software, unauthorized access or transactions, data breaches and costly repairs or outages.

A.8.4 · A.8.25 · A.8.26 · A.8.27 · A.8.28 · A.8.29 · A.8.30 · A.8.31 · A.8.33

A supplier or cloud provider exposes information, introduces a security weakness or interrupts a critical service.

Root cause: Weak supplier checks or agreements, unclear shared responsibilities, uncontrolled service changes or a supplier incident or failure.

Consequence: Data exposure, unavailable services, interrupted customer delivery and difficult recovery or supplier replacement.

A.5.19 · A.5.20 · A.5.21 · A.5.22 · A.5.23 · A.8.30

Important information is deleted, corrupted or becomes unreadable and cannot be restored when needed.

Root cause: Human error, system failure, lost encryption keys or incomplete, inaccessible or untested backups.

Consequence: Permanent loss of records or work, incorrect decisions, interrupted services and reconstruction costs.

A.5.33 · A.8.13 · A.8.24

IT systems or network services become unavailable or too slow to support normal business operations.

Root cause: Hardware or network failure, insufficient capacity, single points of failure, missed warning signs or a denial-of-service attack.

Consequence: Interrupted work, missed deadlines, lost revenue and failure to meet service commitments.

A.7.13 · A.8.6 · A.8.14 · A.8.16 · A.8.20 · A.8.21

A major disruption prevents critical activities from resuming in time or forces staff to use insecure workarounds.

Root cause: Missing or untested continuity and recovery plans, unclear recovery priorities or dependence on one location, person or supplier.

Consequence: Prolonged interruption, additional data exposure or loss, missed customer commitments and financial damage.

A.5.29 · A.5.30 · A.8.13 · A.8.14

A security incident goes unnoticed or is handled too slowly or incorrectly, allowing the damage to increase or recur.

Root cause: Missed alerts, incomplete logs, unclear reporting or escalation, missing external contacts, or weak response and follow-up.

Consequence: A breach spreads, recovery takes longer, evidence is lost and reporting obligations may be missed.

A.5.5 · A.5.6 · A.5.7 · A.5.24 · A.5.25 · A.5.26 · A.5.27 · A.5.28 · A.6.8 · A.8.15 · A.8.16 · A.8.17

Sensitive information remains accessible in old files, media or devices after it should have been deleted.

Root cause: Unclear retention periods, forgotten copies or backups, or devices reused or disposed of without verified data removal.

Consequence: Data exposure, privacy complaints and greater impact if retained information is stolen.

A.5.31 · A.5.33 · A.5.34 · A.7.10 · A.7.14 · A.8.10

Information, software or third-party content is used in a way that breaches legal, contractual or confidentiality obligations.

Root cause: Unknown requirements, inappropriate use of personal data, missing confidentiality terms or incorrect use of licensed software or content.

Consequence: Complaints, claims, possible penalties, loss of customer contracts or restrictions on business activities.

A.5.31 · A.5.32 · A.5.33 · A.5.34 · A.5.36 · A.6.2 · A.6.6

A system change, maintenance action or audit test causes an outage, incorrect processing or data exposure.

Root cause: Poorly assessed changes, missing approval or testing, unsafe work on production systems, or no workable rollback plan.

Consequence: Interrupted services, incorrect or lost data, new security weaknesses and recovery work.

A.5.8 · A.5.37 · A.8.9 · A.8.18 · A.8.19 · A.8.31 · A.8.32 · A.8.34