Stale risk register at a 300-store retailer
HarborMart Retail operates 310 stores, an e-commerce site, and a loyalty programme with 4.2 million members. Its ISO/IEC 27005-based risk assessment was completed 16 months ago as part of ISO/IEC 27001 certification. The risk register is a spreadsheet owned by the information security manager; store managers have never seen it. Key risk indicators are not defined. The risk committee meets annually and receives a one-page summary. Last month, threat intelligence reported a credential-stuffing campaign against retail loyalty APIs in the region; the register still rates 'customer account takeover' as likelihood 2, impact 3, last reviewed before the campaign. The SIEM shows 14,000 failed logins per hour against the loyalty API from 30 countries, but no rule maps this to the risk register. The next surveillance audit is in five months, and the auditor has asked for evidence of monitoring and review.
1. Design a monitoring and review process for HarborMart that would have detected and escalated this change. Include triggers, indicators, and roles.
Read the worked answer
Monitoring design. Define key risk indicators with thresholds, data sources, frequency, and owners. For account takeover: failed-login rate per hour, ratio of failures to successes, MFA coverage, successful logins from new countries or hosting providers, credential-stuffing signatures, customer complaints, fraud losses, and API latency. Set thresholds against a baseline; for example, failed logins above three times baseline for 30 minutes triggers SOC investigation and notification of the loyalty risk owner.
Review cycle. Use monthly operational review of indicators, quarterly risk-committee review, and an annual full reassessment. Add event-driven triggers: threat-intelligence report, confirmed incident, significant change, audit finding, metric breach, new API or store acquisition, and regulatory change. The annual committee alone is insufficient.
Roles. The business owner of the loyalty programme owns the risk; the API owner and SOC own controls; the information security manager maintains the register; the CISO escalates; internal audit provides independent assurance. The risk committee decides on acceptance and resources.
Link to ISO/IEC 27001. Align with monitoring, measurement, analysis and evaluation, internal audit, and management review requirements, and with ISO/IEC 27005 monitoring and review guidance. Record decisions, changes to likelihood and impact, and actions. The credential-stuffing signal should update the register, not sit only in the SIEM.
2. What should be communicated to whom, and how should the credential-stuffing signal be recorded?
Read the worked answer
Communication map. The risk committee needs the risk trend, whether the rating is still valid, and the decision required. The SOC and fraud team need indicators and response actions. The loyalty business owner needs customer and revenue impact. Customer service needs approved scripts. The DPO and legal team need a breach-assessment view. Customers should not be alarmed prematurely, but if accounts are compromised, notification may be required. The regulator should be informed only if the legal assessment triggers a notification obligation.
Consultation. Consult the API owner and fraud team before changing the rating; threat intelligence is an input, not proof of compromise. Confirm whether failures are credential stuffing, a misconfigured client, or a load test.
Recording. Record the date and time, source, indicators, affected service, observed evidence, assessment of likelihood and impact, confidence, interim actions, owner, and review date. Distinguish intelligence from confirmed incident. Link the record to the risk register and incident ticket, and preserve logs. Record who was informed and what they decided. This creates an auditable trail and avoids the common failure of reacting in the SOC without updating the risk picture.
3. The auditor asks for evidence that the risk assessment is reviewed at planned intervals and on significant change. What evidence would you assemble, and what gaps remain?
Read the worked answer
Evidence available or to assemble. The risk methodology and criteria, register version history, risk-committee minutes, management-review records, internal audit reports, treatment tracker, KRI dashboard, incident and postmortem records, threat-intelligence reports, change records, and risk-acceptance decisions. These show whether the process is operating, not merely documented.
Gaps. The full assessment is 16 months old with no documented review interval; store managers have not been consulted; no KRIs exist; the committee meets annually; there is no trigger from threat intelligence or the SIEM; and the register is not linked to operational monitoring. These are substantive weaknesses in monitoring and review, even if certification was previously achieved.
Corrective action. Define and approve review frequency and triggers, update the register now with the credential-stuffing evidence, add KRIs and owners, schedule quarterly risk-committee reviews, involve store and business managers, and create a documented trail from intelligence to risk decision. Provide the auditor with a gap analysis and dated action plan. Do not claim that the annual summary is sufficient evidence of continuous monitoring; show the corrected process and its operation.