Rescoring a Cloud CRM Risk Before Go-Live
A retail bank is migrating its customer relationship management (CRM) system to a multi-tenant SaaS provider. The project risk register entry, owned by the CRM program director, scores the risk as likelihood 2, impact 4 = 8, below the board's appetite threshold of 12. The security reviewer argues for likelihood 4, impact 5 = 20 because the provider cannot contractually guarantee data residency in the bank's country, the tenant isolation model has not been independently tested, and the exit plan depends on a proprietary data export. The program director says the vendor has ISO 27001 and SOC 2 Type II reports, the go-live is in six weeks, and rescoring would force a board paper. The bank handles 2.4 million retail accounts; the CRM holds contact details and marketing preferences, not account balances. The risk framework requires likelihood and impact to be supported by evidence and calibrated against a 5x5 matrix.
1. How should the risk score be resolved? Specify the process, evidence, and decision rights.
Read the worked answer
Resolve it through the risk framework, not by negotiation between two scores. Require evidence for each dimension: the contract and data-flow map for residency; an independent tenant-isolation test or the provider's most recent penetration-test scope; and a tested exit plan with sample export. Because the CRM holds contact details and preferences, not balances, impact 5 may be overstated, but likelihood 4 may be supported by unproven isolation and residency gaps. A calibrated score might be 4x4=16, still above appetite. The program director owns the risk but does not unilaterally set the score above the framework. The risk committee or CISO should adjudicate, with security documenting dissent if overruled. The board paper is the correct consequence, not a reason to avoid rescoring.
2. What treatment plan would bring the residual risk within appetite before go-live?
Read the worked answer
Treatment should target the evidence gaps: a contractual data-residency commitment with audit rights; independent tenant-isolation testing or a scoped penetration test; a documented exit plan with a live export test and retention period; data minimization so marketing preferences are not over-retained; field-level encryption or tokenization for sensitive contact data; DLP and anomaly monitoring on bulk exports; and a phased go-live with rollback criteria. Each action should have an owner and date before go-live. Re-score after the evidence is produced. If the provider will not accept residency or testing terms, the residual risk may remain above appetite, and the bank should consider a different deployment model or delay. Do not treat ISO 27001 and SOC 2 as substitutes for the specific gaps.
3. If the program director accepts the residual risk without rescoring, what should security do?
Read the worked answer
Security should not silently accept it. Document the rejected evidence requests, the framework score, and the program director's rationale. Escalate to the CISO and risk committee under the bank's risk-acceptance policy. Confirm whether the program director has authority to accept a risk above the board threshold; if not, the acceptance is invalid. If escalation is overruled, record a formal exception with a time limit, compensating controls, and a review date. Preserve the dissent in the risk register so auditors can see the decision trail. Security should continue monitoring the specific gaps and require the go-live decision to be made with the residual risk stated in writing, not hidden behind a score of 8.