Purpose
Define how Perfect Wiki identifies, evaluates, treats, and monitors risks to the confidentiality, integrity, and availability of its service and customer data.
Scope
Information-security and operational risks across people, processes, technology, and third parties involved in delivering the Perfect Wiki service.
Risk methodology
- Likelihood: Rare, Unlikely, Possible, Likely, Almost Certain.
- Impact: Negligible, Minor, Moderate, Major, Severe — measured against customer data, service availability, finances, and reputation.
- Risk rating: Combined likelihood × impact, classified Low / Medium / High / Critical.
Risk treatment
- Mitigate: Implement controls that reduce likelihood or impact (default for High and Critical risks).
- Transfer: Use third-party services with stronger controls, contractual indemnities, or cyber insurance.
- Avoid: Stop or do not start the activity creating the risk.
- Accept: Document and approve residual risk with explicit sign-off by the CEO/CTO.
Process
- Risks are identified continuously by the CEO/CTO and from inputs such as vulnerability findings, incidents, vendor advisories, and customer feedback.
- Each risk is recorded with: description, asset affected, likelihood, impact, rating, owner, treatment, and target date.
- The risk register is reviewed at least annually and after any SEV1/SEV2 incident.
- Treatment actions feed into engineering and operational backlogs.
Top risk categories tracked
- Unauthorized access to customer data (mitigated by RBAC, SSO/MFA-inherited authentication, least privilege).
- Data loss or corruption (mitigated by daily encrypted backups with documented RTO/RPO).
- Third-party / sub-processor compromise (mitigated by vendor-management policy).
- Application vulnerabilities (mitigated by SDLC + vulnerability-management policy).
- Key-person dependency (mitigated by documentation and successor credentials).
Roles & responsibilities
- CEO/CTO: Owns the risk register and approves treatment decisions.
Review cadence
Reviewed annually.
Last reviewed: 2026-05-21. Next review: 2027-05-21. Approved by: Ilia Pirozhenko, CEO/CTO.