Case 4 - A Low Rating That Outlived Its Assumption
Ashcombe University last performed an information security risk assessment 26 months ago, before it migrated its learning platform to a cloud provider. Under its methodology, low-rated risks are reviewed every three years. The cloud migration was approved through a change process focused on budget and timetable; no security risk assessment was performed because 'the supplier is ISO/IEC 27001 certified'. Six weeks after go-live, a storage bucket containing 14,000 student records was found publicly readable. The risk 'misconfiguration of cloud storage exposes student data' had been identified in the earlier assessment and rated Low, with the note 'no cloud storage in use'. The regulator has asked how the risk was monitored between assessment and incident. The CISO argues that certification of the supplier discharged the risk.
1. Where did the process fail? Refer to monitoring and review, and to the relationship between risk assessment and change management.
Read the worked answer
At least four points.
First, the assessment was treated as a one-off event rather than a continuing process. ISO/IEC 27005 expects monitoring and review with defined triggers.
Second, the Low rating rested on a stated condition - 'no cloud storage in use' - which the migration invalidated. That condition should have been recorded as a trigger, so that the migration automatically forced reassessment.
Third, the change process approved the migration on budget and timetable only. Security risk assessment belongs in the management of change, because a new service alters threats, vulnerabilities and consequences.
Fourth, supplier certification was misused. ISO/IEC 27001 certification says something about the supplier's management system and its scope; it says nothing about how the university configured a bucket, and it does not discharge the university's own risk. The shared responsibility split should have been documented and the university-side configuration controls assessed. The three-year interval was defensible only while the assumptions held.
2. Design appropriate review triggers and explain how low-rated risks should be handled.
Read the worked answer
Triggers should include: introduction or material change of a service, supplier or architecture; acquisition or outsourcing; incidents and near misses; credible new threat or vulnerability information; changes in legal, regulatory or contractual obligations; failure or expiry of a control; and the passage of the defined interval.
For low-rated risks, a longer interval is proportionate, but only if the assumptions behind the rating are documented and each assumption is itself a trigger. Maintain a watch list of low risks whose context may change, and link the register to the change process so that a change request must reference affected risks.
Each review should ask whether likelihood, consequence, controls or criteria have changed, and record the answer and the reviewer. Low risk is not the same as no monitoring obligation, and a rating inherited from a different context is not an assessment - it is an assumption with a number attached.
3. How should the supplier's ISO/IEC 27001 certificate be used in the risk assessment?
Read the worked answer
As one input among several, never as a substitute. Obtain the certificate and its scope statement to check that the relevant services and locations are covered. Ask for the Statement of Applicability, the latest surveillance or recertification report, and any SOC 2 or equivalent report. Clarify the shared responsibility model and which controls the university operates: configuration, identity, key management, logging.
Certification reduces uncertainty about the supplier's management system but not about this specific configuration, and it does not transfer risk. Record it as evidence supporting the assessment of supplier-related controls, with notes on scope, validity and exclusions, and set a review trigger at expiry or on significant change.
Contractual rights - audit, breach notification, security requirements - remain part of the treatment and should be assessed for effectiveness like any other control.