Docs

Appearance

Risk Acceptance Register ​

Purpose: Document every risk that has been identified, evaluated, and — rather than fully mitigated — formally accepted by the Security Officer for a defined period. Supports HIPAA §164.308(a)(1)(ii)(B) (Risk Management) and SOC2 CC3.2/CC3.3.

Owner: Rory (Security Officer) Audience: Security Officer, auditors, leadership Update cadence: On each acceptance decision and at least quarterly; every entry re-evaluated at its review date Last refreshed: 2026-06-27

Rules for risk acceptance ​

  1. Only the Security Officer may accept risk on behalf of Cirius Group. No auto-acceptance by agents or workflows.
  2. NEVER use ACCEPTED_RISK status on a HIPAA control (per CLAUDE.md hard rule). This register is for non-HIPAA gaps or for HIPAA gaps that have a compensating control which can be attested.
  3. Every accepted risk has a defined expiry date. If the risk is not closed by that date, the acceptance lapses and the risk must be re-evaluated.
  4. Every accepted risk must name a compensating control that reduces the residual risk, even if it does not eliminate the requirement.
  5. Entries are immutable once accepted — updates are additive (append a new entry that supersedes the old).

Template for a new entry ​

### <Unique ID> — <Short title>
- **Risk description:** <1–3 sentences>
- **Likelihood:** LOW / MEDIUM / HIGH
- **Impact:** LOW / MEDIUM / HIGH / CRITICAL
- **Residual risk after compensating controls:** LOW / MEDIUM / HIGH
- **Compensating controls in place:** <bullets>
- **Acceptance rationale:** <why accepting rather than remediating now>
- **Accepted by:** Rory
- **Accepted on:** YYYY-MM-DD
- **Review date:** YYYY-MM-DD
- **Expiry date:** YYYY-MM-DD (acceptance lapses on this date unless renewed)
- **Tracking story:** <SecOps story ID>
- **Related framework control:** <e.g. HIPAA §164.308(a)(5)(ii)(D), SOC2 CC6.1, compliance/compliance-scorecard.md row #>

Current accepted risks ​

RA-2026-001 — FIDO2 phishing-resistant MFA for privileged accounts ​

  • Risk description: Global Admin and PIM Privileged Role Admin accounts currently authenticate with Microsoft Authenticator app (TOTP / push). This is vulnerable to real-time phishing / MFA fatigue / SIM swap against the user's phone. FIDO2 hardware keys were scheduled for Q1 2026 deployment but slipped due to hardware procurement delays (vendor lead time).
  • Likelihood: MEDIUM (ransomware affiliates increasingly run AiTM phishing kits)
  • Impact: CRITICAL (privileged account compromise = full domain / tenant compromise)
  • Residual risk after compensating controls: MEDIUM
  • Compensating controls in place:
    • All privileged roles are eligible-only via PIM (no standing access)
    • Conditional Access blocks legacy authentication tenant-wide
    • Keeper Security records every privileged session
    • Sign-in risk policy requires reauthentication on HIGH risk score
    • Monthly privileged access review per runbooks/monthly-security-review.md §1
    • Break-glass accounts are separate and have their own hardware keys on-hand
  • Acceptance rationale: Hardware keys on order; deployment scheduled for Q3 2026 (target end of July). Accepting the two-quarter gap rather than deferring unrelated work.
  • Accepted by: Rory
  • Accepted on: 2026-04-15
  • Review date: 2026-09-01 (renewed 2026-06-27: CA-RemoteAccess-CompliantDeviceFIDO2 Conditional Access policy deployed in report-only mode in azure-infra; hardware rollout Q3 2026; on track for enforcement before audit)
  • Expiry date: 2026-09-30 (FIDO2 must be deployed before SOC2 audit)
  • Tracking story: SEC-FIDO2-2026
  • Related framework control: HITRUST 01.q, compliance-scorecard.md row 11

RA-2026-002 — Incident Response retainer not in force ​

  • Risk description: Cirius Group does not currently have a commercial IR retainer with a specialist firm (Mandiant, Kroll, CrowdStrike Services, etc.). In a major incident requiring forensic imaging, negotiation assistance, or legal-privileged investigation, engagement would need to be stood up under duress.
  • Likelihood: LOW (infrequent)
  • Impact: HIGH (time-critical during a major event)
  • Residual risk after compensating controls: MEDIUM
  • Compensating controls in place:
    • Arctic Wolf MDR provides 24×7 monitoring and act-first containment across all managed VLCs
    • Cortex XDR provides on-host forensic collection capability
    • SecOps platform maintains a 6-year immutable audit trail (Azure WORM + AWS Object Lock)
    • Legal counsel relationship established (external counsel on call)
    • runbooks/incident-response.md documents the full response process; November 2024 incident taught us the critical steps
  • Acceptance rationale: Vendor evaluation in progress (Q2). Quote comparisons and scope definition take priority over signing a premature retainer. Accept for one additional quarter.
  • Accepted by: Rory
  • Accepted on: 2026-04-15
  • Review date: 2026-07-15
  • Expiry date: 2026-09-30 (IR retainer target before SOC2 audit)
  • Tracking story: SEC-IR-RETAINER-2026
  • Related framework control: SOC2 CC7.3, HITRUST 11.a, compliance-scorecard.md row 43

RA-2026-003 — Privileged session recording not available on current Keeper tier ​

  • Risk description: SOC2 CC6.1 and HITRUST 01.w require privileged session recording — capture of the full interactive session (keystrokes, screen, commands) for privileged accounts accessing critical systems. Cirius currently runs Keeper Business tier, which does not include the KeeperPAM session recording add-on. Privileged sessions are opened through Keeper but the video/keystroke record is not captured.
  • Likelihood: LOW (the gap affects auditability, not active threat exposure; credentials are still managed through Keeper)
  • Impact: MEDIUM (forensic blind spot during a privileged insider or compromised-admin scenario; a key SOC2 evidence gap)
  • Residual risk after compensating controls: LOW-MEDIUM
  • Compensating controls in place:
    • Entra PIM: all privileged roles are eligible-only; every activation is logged with justification and duration to Entra audit log → LAW → SecOps
    • Entra Conditional Access: privileged actions require a compliant device + MFA; session tokens are short-lived
    • Azure Activity Log: all management-plane actions (resource create/modify/delete) are logged with caller identity and timestamp, retained 6 years
    • SecOps anomaly detection: elevated-privilege logins are monitored by the identity agent; any unexpected privileged action fires a finding
    • Keeper Audit Log: records every credential access event (who, when, which record) — not a full session record but shows what was retrieved
  • Acceptance rationale: KeeperPAM add-on is under evaluation (compliance/pam-evaluation.md). Cost and implementation effort require a Q3 decision rather than immediate upgrade. Compensating controls (PIM audit log + Azure Activity Log) provide substantial detective coverage for the audit period. This is a SOC2 gap, not a HIPAA violation.
  • Accepted by: Rory
  • Accepted on: 2026-06-27
  • Review date: 2026-09-01
  • Expiry date: 2026-09-30 (decision required before SOC2 audit: upgrade to KeeperPAM or document as a known gap with compensating controls)
  • Tracking story: SEC-PAM-SESSION-2026
  • Related framework control: SOC2 CC6.1, HITRUST 01.w, compliance-scorecard.md row 35

Superseded entries ​

(None yet. When an entry is replaced or closed, its final state is appended here with the closure reason.)

Process ​

  1. Identification: A control gap or risk is identified in a risk analysis, penetration test, audit, or tabletop
  2. Evaluation: Security Officer evaluates likelihood, impact, and whether remediation within SLA is feasible
  3. Decision: If remediation cannot occur within the framework SLA (CRITICAL 7d / HIGH 30d / MEDIUM 90d), formal acceptance is required
  4. Documentation: Security Officer writes the entry here; SecOps story opened for tracking
  5. Compensating controls: Actively operated and verified during monthly security review
  6. Review: Every entry re-evaluated at its review date; renewed, downgraded, closed, or escalated as appropriate

Document history ​

DateChangeAuthor
April 2026Initial register with two accepted risks (FIDO2 rollout, IR retainer)Kobe
June 2026Added RA-2026-003 (Keeper session recording — KeeperPAM not on current tier); renewed RA-2026-001 review date to 2026-09-01 (CA policy deployed in report-only mode, FIDO2 hardware Q3)Kobe

Internal use only — Cirius Group