• Conducted an enterprise risk assessment across 6 core infrastructure and software domains, identifying critical gaps in identity management, legacy systems, and data resiliency.

• Evaluated each risk using standard Impact and Likelihood scoring (1–5 scale) to calculate overall risk levels and prioritise solutions, and documented the rationale behind decisions and proposed strategies.

• Authored formal policies establishing mandatory MFA, Jump Host controls, and rules for software usage.

Risk Register

Rationale

• RSK-001 Impact Level: a compromise on the production database could result in loss of customer trust, regulatory penalties (GDPR fines), or data exfiltration.

• RSK-001 Likelihood Level: administrators are a target for phishing attacks.

• RSK-002 Impact Level: high, because these systems lack patches to vulnerabilities like zero day exploits.

• RSK-002 Likelihood Level: low, because exiting controls protect the internal network.

• RSK-002 Recommended Treatment: recommending to decommission systems immediately could disrupt business operations.

• RSK-003 Risk Description: In 2013 attackers executed a supply chain breach on Target Corporation by stealing login credentials from an outside HVAC vendor, moving laterally through Target's unsegmented network to eventually steal credit card details of millions of customers. huntress.com/threat-library/data-breach/target-data-breach

Policies