Risk Management Policy
Last updated: October 22, 2026
Summerbase ApS assesses security risks at least yearly, scores them by likelihood and impact, and either treats them or has the CEO formally accept them.
Scope
Risks to the confidentiality, integrity and availability of company and customer data, including fraud risk, vendor risk and legal/regulatory risk.
Process
- Identify. The Security Officer, with the CTO and CEO, identifies risks at least yearly and when there are significant changes (new region, product, major vendor, acquisition). Sources include threats, vulnerabilities, incidents, audit findings and vendor reviews.
- Assess. Each risk is scored for likelihood (1–5) and impact (1–5); risk score = likelihood × impact.
- Treat. Risks scoring above 12 must be treated: mitigate with controls, transfer (for example insurance or contracts), or avoid. Risks at or below 12 may be accepted.
- Accept. Accepted risks are approved in writing by the CEO with a reason and review date.
- Register. All risks are recorded in the risk register with owner, score, treatment, residual score and status.
- Fraud. The assessment considers fraud risk, such as misuse of access or financial fraud, as SOC 2 CC3.3 requires.
- Monitor. The register is reviewed by the CEO and Security Officer at least once a year, and treatment progress is tracked.
Risk register template
| ID | Risk | Likelihood (1–5) | Impact (1–5) | Score | Treatment | Owner | Residual score | Review date |
|---|---|---|---|---|---|---|---|---|
| R-01 | Compromise of an engineer’s GCP credentials | 3 | 5 | 15 | MFA, least privilege, audit alerts | CTO | 6 | Yearly |
| R-02 | Customer data stored outside the agreed region | 2 | 5 | 10 | Org policy location restriction, region labels, reviews | CTO | 4 | Yearly |