This policy establishes the scope, objectives, and procedures of JupiterOne’s information security risk management process. The risk management process is intended to support and protect the organization and its ability to fulfill its mission.
JupiterOne policy requires that:
(a) A thorough risk assessment must be conducted to evaluate the potential threats and vulnerabilities to the confidentiality, integrity, and availability of customer data (and other confidential and proprietary electronic information) stored, transmitted, and/or processed by JupiterOne’s production systems.
(b) Risk assessments must be performed with any major change to JupiterOne’s business or technical operations and/or supporting infrastructure, no less than once per year. RISK1
(c) Strategies shall be developed to mitigate or accept the risks identified in the risk assessment process.
(d) JupiterOne will maintain documentation of all risk assessment, risk management, and risk mitigation efforts for a minimum of seven years.
JupiterOne has established formal risk analysis and risk management processes to:
identify risks that may impact its business operations or the confidentiality, integrity and availability of its critical data; and
reduce risk to an acceptable level by implementation of mitigation controls.
Unmitigated risk above the pre-defined acceptable level must be reviewed, approved and accepted by senior management.
Risks that are either low impact or low probability, based on the scoring mechanism defined in risk assessment process, are generally considered acceptable.
All other risks must be individually reviewed and managed according to the risk management process.
Risk analysis and risk management are recognized as important components of JupiterOne’s corporate compliance program and information security program.
Risk assessments are performed before the integration of new system technologies and before changes are made to JupiterOne logical and technical safeguards.
Note: these changes do not include routine updates to existing systems, deployments of new systems whose design is based on previously configured systems, deployments of new Customers, or new code developed for operations and management of the JupiterOne Platform.
JupiterOne implements security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to:
JupiterOne’s risk management process requires that:
The details of the Risk Management Process, including risk assessment, discovery, and mitigation, are outlined in detail below. The process is tracked, measured, and monitored using the following procedures:
Third party risk management details including procurement and systems acquisition can be found in §vendor.
The two principle components of the risk management process - risk assessment and risk mitigation - will be carried out according to the following schedule to ensure the continued adequacy and continuous improvement of JupiterOne’s information security program:
Scheduled Basis - an overall risk assessment of JupiterOne’s information system infrastructure will be conducted annually. RISK1 The assessment process should be completed in a timely fashion so that risk mitigation strategies can be determined and included in the corporate budgeting process.
Throughout a System’s Development Life Cycle - from the time that a need for a new, untested information system configuration and/or application is identified through the time it is disposed of, ongoing assessments of the potential threats to a system and its vulnerabilities should be undertaken as a part of the maintenance of the system.
As Needed - the Security Officer (or other designated employee) or Risk Management Team may call for a full or partial risk assessment in response to changes in business strategies, information technology, information sensitivity, threats, legal liabilities, or other significant factors that affect JupiterOne’s Platform.
The intent of completing a risk assessment is to determine potential threats and vulnerabilities and the likelihood and impact should they occur. The output of this process helps to identify appropriate controls for reducing or eliminating risk.
Throughout the steps below, the definitions of impact labels like low, medium, and high are as found in NIST publication FIPS-199.
The first step in assessing risk is to define the scope of the effort. To do this, identify where customer data is received, maintained, processed, or transmitted. Using information-gathering techniques, the JupiterOne Platform boundaries are identified.
Output - Characterization of the JupiterOne Platform system, a good picture of the JupiterOne Platform environment, and delineation of JupiterOne Platform boundaries.
Potential threats (the potential for threat-sources to successfully exercise a particular vulnerability) are identified and documented. All potential threat-sources through the review of historical incidents and data from intelligence agencies, the government, etc., to help generate a list of potential threats.
Output - A threat list containing a list of threat-sources that could exploit JupiterOne Platform vulnerabilities.
Develop a list of technical and non-technical JupiterOne Platform vulnerabilities that could be exploited or triggered by potential threat-sources. Vulnerabilities can range from incomplete or conflicting policies that govern an organization’s computer usage to insufficient safeguards to protect facilities that house computer equipment to any number of software, hardware, or other deficiencies that comprise an organization’s computer network.
Output - A list of the JupiterOne Platform vulnerabilities (observations) that could be exercised by potential threat-sources.
Document and assess the effectiveness of technical and non-technical controls that have been or will be implemented by JupiterOne to minimize or eliminate the likelihood / probability of a threat-source exploiting a JupiterOne Platform vulnerability.
Output - List of current or planned controls (policies, procedures, training, technical mechanisms, insurance, etc.) used for the JupiterOne Platform to mitigate the likelihood of a vulnerability being exercised and reduce the impact of such an adverse event.
Determine the overall likelihood rating that indicates the probability that a vulnerability could be exploited by a threat-source given the existing or planned security controls.
Output - Likelihood rating of low (.1), medium (.5), or high (1).
Determine the level of adverse impact that would result from a threat successfully exploiting a vulnerability. Factors of the data and systems to consider should include the importance to JupiterOne’s mission; sensitivity and criticality (value or importance); costs associated; loss of confidentiality, integrity, and availability of systems and data.
Output - Magnitude of impact rating of low (10), medium (50), or high (100).
Establish a risk level. By multiplying the ratings from the likelihood determination and impact analysis, a risk level is determined. This represents the degree or level of risk to which an IT system, facility, or procedure might be exposed if a given vulnerability were exercised. The risk rating also presents actions that senior management must take for each risk level.
Output - Risk level of low (1-10), medium (>10-50) or high (>50-100).
Identify controls that could reduce or eliminate the identified risks, as appropriate to the organization’s operations to an acceptable level. Factors to consider when developing controls may include effectiveness of recommended options (i.e., system compatibility), legislation and regulation, organizational policy, operational impact, and safety and reliability. Control recommendations provide input to the risk mitigation process, during which the recommended procedural and technical security controls are evaluated, prioritized, and implemented.
Output - Recommendation of control(s) and alternative solutions to mitigate risk.
Results of the risk assessment are documented in an official report, spreadsheet, or briefing and provided to senior management to make decisions on policy, procedure, budget, and JupiterOne Platform operational and management changes.
Output - A risk assessment report that describes the threats and vulnerabilities, measures the risk, and provides recommendations for control implementation.
Risk mitigation involves prioritizing, evaluating, and implementing the appropriate risk-reducing controls recommended from the Risk Assessment process to ensure the confidentiality, integrity and availability of JupiterOne Platform data. Determination of appropriate controls to reduce risk is dependent upon the risk tolerance of the organization consistent with its goals and mission.
Using results from Step 7 of the Risk Assessment, sort the threat and vulnerability pairs according to their risk-levels in descending order. This establishes a prioritized list of actions needing to be taken, with the pairs at the top of the list requiring the most immediate attention and top priority in allocating resources.
Output - Actions ranked from high to low
Review the recommended control(s) and alternative solutions from Step 8 of the Risk Assessment for reasonableness and appropriateness. The feasibility (e.g., compatibility, user acceptance, etc.) and effectiveness (e.g., degree of protection and level of risk mitigation) of the recommended controls should be analyzed. Select a “most appropriate” control option for each threat and vulnerability pair.
Output - list of feasible controls
Determine the extent to which a control is cost-effective. Compare the benefit (e.g., risk reduction) of applying a control with its subsequent cost of application. Controls that are not cost-effective are also identified during this step. Analyzing each control or set of controls in this manner, and prioritizing across all controls being considered, can greatly aid in the decision-making process.
Output - Documented cost-benefit analysis of either implementing or not implementing each specific control
Taking into account the information and results from previous steps, JupiterOne’s mission, and other important criteria, the Risk Management Team determines the best control(s) for reducing risks to the information systems and to the confidentiality, integrity, and availability of customer data. These controls may consist of a mix of administrative, physical, and/or technical safeguards.
Output - Selected control(s)
Identify the workforce members with the skills necessary to implement each of the specific controls outlined in the previous step, and assign their responsibilities. Also identify the equipment, training and other resources needed for the successful implementation of controls. Resources may include time, money, equipment, etc.
Output - List of resources, responsible persons and their assignments
Develop an overall implementation or action plan and individual project plans needed to implement the safeguards and controls identified. The Implementation Plan should contain the following information:
The overall implementation plan provides a broad overview of the safeguard implementation, identifying important milestones and timeframes, resource requirements (staff and other individuals’ time, budget, etc.), interrelationships between projects, and any other relevant information. Regular status reporting of the plan, along with key metrics and success indicators should be reported to JupiterOne Senior Management.
Individual project plans for safeguard implementation may be developed and contain detailed steps that staff members assigned carry out to meet implementation timeframe and expectations. Additionally, consider including items in individual project plans such as a project scope, a list of deliverables, key assumptions, objectives, task completion dates and project requirements.
Output - Safeguard Implementation Plan
As controls are implemented, monitor the affected system(s) to verify that the implemented controls continue to meet expectations. Elimination of all risk is not practical. Depending on individual situations, implemented controls may lower a risk level but not completely eliminate the risk.
Continually and consistently communicate expectations to all Risk Management Team members, as well as senior management and other key people throughout the risk mitigation process. Identify when new risks are identified and when controls lower or offset risk rather than eliminate it.
Additional monitoring is especially crucial during times of major environmental changes, organizational or process changes, or major facilities changes.
If risk reduction expectations are not met, then repeat all or a part of the risk management process so that additional controls needed to lower risk to an acceptable level can be identified.
Output - Residual Risk documentation
JupiterOne Security Team maintains a registry of risks, captured and kept updated:
The risk registry includes all risks and threats identified during annual risk assessment and all interim reviews. RISK1
JupiterOne holds cyber liability insurance with sufficient coverage based on the organization’s risk profile.
Our current Cyber and Commercial Crime policies are covered by Clear Blue Insurance Co.
Due to its transparent culture, team size and operating model, including separation of duties, comprehensive controls, continuous monitoring and auditing, JupiterOne considers its fraud-related risk to be very low.
JupiterOne hires KSM Business Services to perform accounting services and annual financial reviews. RISK3
Fraud risk is re-evaluated as part of the organization’s annual risk assessment. RISK1
The assessment considers the following aspects of fraud:
Financial-related fraud assessment is led by the Finance and HR department.
IT-related fraud assessment is led by the Security Officer.
|Fraud Risk||Likelihood||In Place Controls/Monitors|
|Fraudulent Financial Reporting||Low||Monthly executive team reviews of business plan and revenue RISK4 Financial review by external accounting firm;Quarterly Board of Directors meetings where financial performance is reviewed; Quarterly investor reporting of financial results is supplied to major investors and reviewed by their respective teams.|
|Misappropriation of Assets||Low||Expense reporting and asset tracking in place|
|Regulatory and Legal Misconduct||Low||Audit and compliance policies and processes, including whistleblower procedures; engage external law firm to review legal conduct|
|Payroll Fraud||Low||Payroll is reviewed by at least two people internally as well as by external accounting firm|
|Kickbacks / Conflict of Interest||Low||Team-based vendor review and selection process|
|Misuse of Cloud Resources||Low||Continuous resource monitoring for all cloud accounts and regions and expense monitoring|
|Other IT Fraud||Low||IT assets and resources tracking|
It is the policy of JupiterOne to prohibit and actively prevent money laundering and any activity that facilitates money laundering or the funding of terrorist or criminal activities.
All employees of JupiterOne must comply strictly and in good faith with the letter and spirit of all antitrust laws in any location in which JupiterOne transacts business. Antitrust laws are designed to protect and promote free and open competition, a policy which JupiterOne believes is in the best interest of the Company, its competitors and suppliers, and its customers.