Risk Management

We evaluate security risks at various stages of the software design and development lifecycle, as needed. Identified risks are assessed for their likelihood and impact and then ranked accordingly. Risks are prioritized and mapped using our risk management policy, and we employ different risk response strategies depending on their severity, including mitigation, acceptance, transfer, or elimination.

VONQ maintains a Risk Register and Treatment Plan, ranking risks by likelihood and severity/impact as critical, high, medium, low, or negligible. We respond to risks in a prioritized fashion, considering cost, work effort, and availability of resources. Periodic reports are made to senior leadership to ensure risks are being mitigated appropriately and in accordance with business priorities and objectives.

Our CEO is accountable for the acceptance and/or treatment of critical or high business risks to the organization. The VP of Engineering and VP of Product can approve the avoidance, remediation, transference, or acceptance of any risk cited in the Risk Register. The DevOps Engineer is responsible for adherence to this policy.

VONQ reserves the right to modify, amend, or terminate this policy at any time. Requests for an exception to this policy must be submitted to the VP of Engineering or VP of Product for approval. Any known violations of this policy should be reported to the VP of Engineering or VP of Product, and wilful or intentional violations can result in disciplinary action in accordance with company procedures up to and including termination of employment.