# Risk Management Policy

**Touch2Sign Ltd**  
**Version:** 1.0  
**Effective date:** 11 July 2026  
**Owner:** Robert — Security Lead  
**Approved by:** Robert — CEO / Managing Director  
**Next review:** 11 July 2027

---

## 1. Purpose

Establish a consistent approach to identifying, assessing, treating, and monitoring information security risks across the Touch2Sign eSignature and eWitness platform. Supports ISO 27001 Clause 6.1 and SOC 2 risk assessment requirements.

## 2. Scope

Covers risks affecting:

- Confidentiality, integrity, and availability of customer data and documents  
- Regulatory compliance (GDPR, eIDAS, ISO 27001, SOC 2)  
- Third-party and sub-processor dependencies  
- Business continuity and reputational impact  

Applies to all Touch2Sign departments; owned operationally by the Security Lead.

## 3. Risk management framework

Touch2Sign follows a continuous cycle:

1. **Identify** — threats and vulnerabilities (risk register, audits, incidents)  
2. **Assess** — likelihood × impact scoring  
3. **Treat** — mitigate, transfer, accept, or avoid  
4. **Monitor** — quarterly review; update after incidents  
5. **Report** — CEO and board summary semi-annually  

## 4. Risk register

Maintained by Security Lead in [GRC tool / spreadsheet — location TBD].

Minimum fields:

| Field | Description |
|-------|-------------|
| Risk ID | RISK-YYYY-NNN |
| Title | Short description |
| Category | Technical / legal / operational / third-party |
| Threat | What could happen |
| Vulnerability | Weakness exploited |
| Asset affected | Documents, IDV, platform, reputation |
| Existing controls | Current mitigations |
| Likelihood | 1–5 (see matrix) |
| Impact | 1–5 (see matrix) |
| Inherent risk | L × I before treatment |
| Treatment | Mitigate / transfer / accept / avoid |
| Action plan | Specific tasks, owner, due date |
| Residual risk | L × I after treatment |
| Risk owner | Named individual |
| Review date | Next review |
| Status | Open / monitoring / closed |

## 5. Likelihood and impact matrix

### 5.1 Likelihood

| Score | Label | Description |
|-------|-------|-------------|
| 1 | Rare | Unlikely in 3+ years |
| 2 | Unlikely | Possible but not expected annually |
| 3 | Possible | May occur once per year |
| 4 | Likely | Expected annually |
| 5 | Almost certain | Multiple times per year or active trend |

### 5.2 Impact

| Score | Label | Description |
|-------|-------|-------------|
| 1 | Negligible | No customer impact; internal only |
| 2 | Minor | Single customer inconvenience; < €10k |
| 3 | Moderate | Multi-customer impact; regulatory inquiry possible |
| 4 | Major | Data breach; ICO/DPC investigation; significant revenue loss |
| 5 | Severe | Mass document leak; platform outage > 24h; existential reputational harm |

### 5.3 Risk score

**Risk score = Likelihood × Impact**

| Score range | Rating | Action |
|-------------|--------|--------|
| 1–4 | **Low** | Monitor; accept with documentation |
| 5–9 | **Medium** | Treat within 90 days; Security Lead owner |
| 10–15 | **High** | Treat within 30 days; CEO informed |
| 16–25 | **Critical** | Immediate treatment; CEO approval for acceptance |

## 6. Risk appetite

Touch2Sign's risk appetite statements:

- **Zero tolerance** for unencrypted customer documents at rest  
- **Zero tolerance** for production access without MFA  
- **Low appetite** for US transfer of document content without SCCs and DPIA (Anthropic)  
- **Low appetite** for PHI processing — default out of scope  
- **Moderate appetite** for single-region AWS dependency — mitigated by DR plan  

Residual risks above **High** require CEO written acceptance with expiry date.

## 7. Risk treatment options

| Option | When to use | Example |
|--------|-------------|---------|
| **Mitigate** | Controls can reduce likelihood or impact | Enable WAF; quarterly access reviews |
| **Transfer** | Insurance or contractual shift | Cyber insurance; Stripe PCI scope |
| **Accept** | Cost of control exceeds risk; documented | Low legacy dependency |
| **Avoid** | Stop the activity | Discontinue Veriff without DPIA |

## 8. Quarterly risk review

Security Lead convenes **quarterly risk review** with Engineering Lead, DPO, and CEO (or delegate):

Agenda:

1. Review open risks and action plan progress  
2. Add risks from incidents, pentests, audits, new features  
3. Re-score changed risks  
4. Close treated risks with evidence  
5. Escalate overdue High/Critical treatments  
6. Update ISO 27001 Statement of Applicability if applicable  

Minutes retained **3 years**.

## 9. Triggered reviews

Risk register updated within **10 business days** of:

- P1 or P2 security incident  
- Notifiable personal data breach  
- New sub-processor integration  
- Material architecture change (new region, AI feature)  
- Failed audit or pentest Critical finding  

## 10. Touch2Sign key risks (starter register)

| Risk | Category | Initial treatment |
|------|----------|-----------------|
| Signing token compromise | Technical | Time-limited tokens; IR playbook §7.1 |
| RDS/S3 misconfiguration | Technical | IAM least privilege; Security Hub |
| IDV sub-processor breach | Third-party | DPA; vendor monitoring |
| Anthropic document exposure | Third-party | DPIA; minimise content; SCCs |
| Single-region AWS dependency | Operational | DR plan; backup restore tests |
| Insider access abuse | Operational | Access reviews; audit logging |
| Customer uploads PHI | Legal | HIPAA Scope Policy; terms prohibition |

Detailed scoring maintained in live risk register.

## 11. Related documents

- Information Security Policy  
- Incident Response Plan  
- Vendor & Sub-processor Management Policy  
- Vulnerability Management Policy  
- Business Continuity & DR Plan  

## 12. Review

This policy reviewed **annually** and when risk methodology changes.

---

**Approval**

| Name | Role | Signature | Date |
|------|------|-----------|------|
| Robert | CEO / Security Lead | Electronic | 11 July 2026 |