> For the complete documentation index, see [llms.txt](https://calvin-lai.gitbook.io/calvin-lai-security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://calvin-lai.gitbook.io/calvin-lai-security/risk-management/it-risk-and-control-library-policy-and-procedure/risk-library.md).

# Risk Library

| Risk Category         | Risk ID     | Risk Summary                                    | Risk Description                                                            |
| --------------------- | ----------- | ----------------------------------------------- | --------------------------------------------------------------------------- |
| Access Control        | RISK-AC-001 | Inability to maintain individual accountability | Failure to maintain asset ownership, preventing non-repudiation of actions. |
| Access Control        | RISK-AC-002 | Improper assignment of privileged functions     | Failure to implement least privilege.                                       |
| Access Control        | RISK-AC-003 | Privilege escalation                            | Inadequate control over access to privileged functions.                     |
| Access Control        | RISK-AC-004 | Unauthorized access                             | Access granted to unauthorized individuals, groups, or services.            |
| Asset Management      | RISK-AM-001 | Lost, damaged or stolen asset(s)                | Assets are lost, damaged, or stolen.                                        |
| Asset Management      | RISK-AM-002 | Loss of integrity through unauthorized changes  | Unauthorized changes corrupt system integrity.                              |
| Business Continuity   | RISK-BC-001 | Business interruption                           | Latency or outage impacting operations.                                     |
| Business Continuity   | RISK-BC-002 | Data loss / corruption                          | Failure to maintain data confidentiality or integrity.                      |
| Business Continuity   | RISK-BC-003 | Information loss due to technical attack        | Technical attacks (malware, phishing) compromise data/systems.              |
| Business Continuity   | RISK-BC-004 | Information loss due to non-technical attack    | Non-technical attacks (social engineering) compromise data/systems.         |
| Exposure              | RISK-EX-001 | Unmitigated vulnerabilities                     | Vulnerabilities without compensating controls.                              |
| Exposure              | RISK-EX-002 | System compromise                               | Compromise affecting confidentiality, integrity, availability.              |
| Governance            | RISK-GV-001 | Inability to support business processes         | Insufficient security/privacy practices.                                    |
| Governance            | RISK-GV-002 | Incorrect controls scoping                      | Inadequate scoping leading to control gaps.                                 |
| Governance            | RISK-GV-003 | Lack of roles & responsibilities                | Inadequate documented roles/responsibilities.                               |
| Governance            | RISK-GV-004 | Inadequate third-party practices                | Third-party procedures below industry standards.                            |
| Governance            | RISK-GV-005 | Lack of oversight of third-party controls       | Insufficient due diligence on third-party controls.                         |
| Governance            | RISK-GV-006 | Illegal content or abusive action               | Abusive/illegal content impacting operations.                               |
| Incident Response     | RISK-IR-001 | Inability to investigate incidents              | Response corrupts evidence or impedes prosecution.                          |
| Incident Response     | RISK-IR-002 | Improper response to incidents                  | Untimely or inappropriate incident response.                                |
| Incident Response     | RISK-IR-003 | Ineffective remediation actions                 | Lack of oversight on remediation effectiveness.                             |
| Situational Awareness | RISK-SA-001 | Inability to maintain situational awareness     | Inability to detect incidents.                                              |
| Situational Awareness | RISK-SA-002 | Lack of a security-minded workforce             | Workforce lacks security/privacy understanding.                             |