Scenario: New Amazing Company has been supporting a customer service portal for new and existing clients, allowing them to access their accounts and perform general functions. The organization has been working with internal stakeholders and professional services consultants to migrate the internal systems to a third-party provider that will assume management of the data and services. The transition has been underway for nine months and is only a couple of weeks away from full implementation.
During a recent vulnerability scan, however, critical vulnerabilities were identified within several of the key servers. Based on the assessment and findings, immediate actions must be taken to mitigate and/or remediate the risk. The anticipated cost and level of effort to address the risks (taking the systems offline, mobilizing the teams, implementing mitigation measures, etc.) are extensive but feasible. However, by the time the full mitigation and remediation measures are put in place, the other systems should be available. The transition team has stated that it can potentially move up the go-live schedule, but cannot confirm definitively at this time.
Task:
Identify the given risk(s) present within this situation, and be sure to address the following:
What is the risk management treatment that is required (potentially on both sides)?
How would you handle this situation?
How would you work to account for the potential risk(s) and devise measures/actions to address them?
How would you quantify the risk(s)? What is the impact?
How would you manage the risk(s) (accept, avoid, transfer, or mitigate)?
How would you gain consensus among stakeholders?
Justify your answers.
