Risikopolitik/en

Content of the risk policy

The risk policy is a set of settings that are very important for your work in HITGuard. All settings and configurations made here are globally valid. They affect all management systems and can therefore only be edited by experts or administrators. Some points of the risk policy should definitely be fully configured before you begin working in the system. We will draw your attention to these points with a “Warning!”.

Protection targets

With protection targets, you define which topics and areas you want to focus on. You thereby determine the purpose for which you want to operate the management systems. This can, for example, be the confidentiality of information, the company’s creditworthiness, or energy efficiency.
In HITGuard, protection targetsare later used, for example, to record how strongly a risk can affect these protection targets. In addition, in the protection needs analysis you record the criticality of resources separately for each protection target. In the structure analysis, protection targets represent the dependencies between master data. They are also used in many other elements for labeling and classification.

HITGuard is delivered with manufacturer-specific protection targets that are based on various standards and norms. The three protection targets confidentiality, availability, and integrity are derived from information security standards (e.g. ISO/IEC 27001) and are already created and activated in the system upon first start:

• Confidentiality: Only authorized persons can view the information.
• Availability: Those who need the information can access it.
• Integrity: The information is error-free.

The manufacturer-specific protection objectives Recovery Time Objective (RTO) and Recovery Point Objective (RPO) relate to recovery times and data loss, i.e. Business Continuity Management. You can learn more about this here. RTO and RPO are not activated by default. To activate them, simply check the boxes for “Active” and “Display in graph”. Then you still need to add the two protection objectives to your desired management system under Administration> Management systems. If you do not plan to use these two protection targets, simply leave them deactivated. Since specific programming is implemented behind these protection targets, they cannot be used for other purposes.

Some manufacturer-specific protection targets are industry-specific and are therefore not automatically availiable. However, you can import them by clicking on the small triangle in the plus button at the top right. You can then import Behandlungseffektivität (treatment effectiveness), Patientensicherheit (patient safety), and Authentizität (authenticity). In some cases, this may be necessary to import a knowledge base. Geben Sie Ihr Feedback zu BizChat ab.

As an expert user, you can add and edit additional protection targets using the plus button. At the top, you can adjust the sort order via drag and drop. This order is used to list the protection objectives not only on this page, but also in the protection needs analysis.

Overview of the protection targets page

Warning!: You should fully define and configure your protection targets before starting to work with HITGuard. The protection needs analyses and the structural analysis build on them, so making changes to protection targets afterward involves significant additional effort.

Probabilities of occurrence

Probability of occurrence and extent of damage form the two axes of the risk matrix (see below). The probability of occurrence indicates how likely it is that a specific event will occur. The screenshot below shows the page for editing the probabilities of occurrence.

Probability of occurrence mask

You can freely define the classes of probabilities of occurrence. To add a new class, click the plus button. To delete one, click the trash can button. Click on a class to adjust its name and description. In addition, under “At least once in,” you can define how often you expect an event in this class to occur within a given period.

Risk factor

The risk factor is used to calculate a risk indicator for specific risks. For this purpose, the risk factor of the selected probability of occurrence is multiplied by the risk factor of the selected extent of damage.

The risk indicator is used to make risks comparable. The higher the risk indicator, the greater the significance of the risk.

Factual:

This checkbox indicates that this probability of occurrence describes not a potential case of damage, but one that has already occurred. The checkbox can only be selected for a single probability of occurrence, ideally the highest one. Later, during evaluation, this probability of occurrence is marked accordingly in the drop-down menu.

Example of a scale with six probabilities of occurrence

Probability of - occurrence classes	Definition
Extremely rare	At least once in 30 years.
	It is very unlikely that unintended effects will occur.
Very rare	At least once in 10 years.
	It is unlikely that unintended effects will occur.
Rare	At least once in three years.
	There may be unintended effects from time to time.
Probably	At least once a year
	It is likely that unintended effects will occur.
Frequently	At least once a month
	Unintended effects often occur.
Very frequent	At least once a week or more
	Unintended effects occur very frequently or almost always.

Warning! The size of the risk matrix must be fully configured before you begin working in the system. This concerns the number of probabilities of occurrence and extent-of-damage classes. Names, colors, criteria, and other settings can still be adjusted later, but the number of classes cannot.

Criteria for extent of damage

Example: Criteria for extents of damage

This page provides you with pre-settings that allow you to further define the extents of damage (see below). Damage does not necessarily have to be monetary in nature, but can also be defined as a loss of effectiveness, reputational damage, or harm to patients. HITGuard therefore offers the option to freely configure criteria for extents of damage. These criteria are then linked to extent-of-damage classes and are thus used for protection needs analyses.

Extent of damage

Example: Extent of damage High

Extents of damage are divided into levels or classes. These extent-of-damage classes are based on the organization’s risk-bearing capacity. The highest extent-of-damage class should represent the maximum damage that the organization can still bear.
In the screenshot, you can see the page for configuring extent-of-damage classes.

If a data class is assigned to an extent of damage, the extent of damage cannot be deleted. If you cannot delete an extent of damage during the initial setup of HITGuard, it is often because a data class is still linked to that extent of damage. If you change the assignment of the data class, the extent of damage can be deleted. Later, when other elements (e.g. a risk) use the extent of damage, it can no longer be deleted at all.

Warning! The size of the risk matrix must be fully configured before you begin working in the system. This concerns the number of probabilities of occurrence and extent-of-damage classes. Names, colors, criteria, and other settings can still be adjusted later, but the number of classes cannot. It is possible to use different extent-of-damage classifications in two management systems. In the illustration above, two extent-of-damage classifications, “Standard” and “Data protection,” were added. If you want to use such a second extent-of-damage classification, you must create the additional classification for extent of damage and benefit using the top plus button. You must then add new extent-of-damage classes using the lower plus button. Warning: To be able to use the newly created classification, you must assign it to the desired management system under "Risk management → Settings".
Monetary damage:

Here you define how high the monetary damage of a class is.

PNA Edge Weight:

This value is intended to express the dependency on assets. Perform a protection needs analysis(PNA) in HITGuard and select the extent-of-damage levels. HITGuard then takes the PNA edge weight of the damage extent and enters it into the corresponding dependency relationship in the structural analysis. This affects many evaluations when using the structural analysis. Above all, together with the “Protection needs” setting (see below), it influences the classification of protection requirement classes.

We recommend choosing PNA percentage values that are evenly spaced and start at 100% for the highest class. See the example below:

Damage extent class	PNA edge weight
insignificant	10%
Low	20%
Moderately	40%
Up	60%
Catastrophic	100%

Risk factor:

The risk factor serves as a multiplier for calculating the risk indicator of a risk. The risk factor of the selected probability of occurrence is multiplied by the risk factor of the selected extent of damage, thus determining the risk indicator.

The risk ratio serves to rank the risks. The higher the risk indicator, the greater the significance of the risk.

Examplary distribution of risk factors on a color scale from green to red.

This risk factor furthermore serves as criterium for the color of extent-of-damage classes in protection needs reports. On a color scale from green to red, the lowest risk factor results in the color green and the highest in the color red. Risk factors between those two result in colors according to their relative position on the scale from green to red.

Add criterion:

Here you can assign criteria that you previously created under “Criteria for extents of damage” (see above). You should also describe how the criterion is defined for the respective damage class. Using the example “health damage,” you would need to specify which workplace injuries would fall under a “Low extent of damage” and which would be classified as a “High extent of damage.”

Examples for damage extent classes:

Damage extent class	Definition
Low	Monetary damage: > 5.000 Euro and <= 25 Euro
	Patient harm: minor and short-term inconvenience
	Effectiveness loss: no or very limited impact on operations/procedures
	Data and system security: disclosure of a relevant threat or vulnerability has negligible effect
Moderate	Monetary damage: > 25,000 euros and <= 100,000 euros
	Patient damage: temporary and minor injuries, medical intervention required
	Effectiveness loss: very limited or nuisance effect on operations/measures
	Data and system security: disclosure of sensitive information could have negative (financial) consequences and may require resources to remediate.
Catastrophic	Monetary damage: > 10 million euros
	Patient harm: Death
	Loss of effectiveness: planned operations/procedures no longer feasible
	Data and system security: may lead to full disclosure of sensitive information

Criteria for benefits

As with the criteria for extent-of-damage classes, you can define qualitative definitions for benefit categories here. A benefit does not necessarily have to be monetary in nature. It can also be defined by gains in effectiveness, improvement of reputation, or patient health. For this reason, HITGuard offers the option to freely configure criteria for benefits. These criteria can then in turn be mapped to benefits and thus used for protection needs analyses.

Criteria for benefits can be defined under "Risk management → Risk policy → Criteria for benefit".

Example: Criteria for benefits

Benefits

Benefits are divided into classes. These are based on the company's ability to take advantage of opportunities. The highest benefit should, therefore, be based on the maximum benefit the company is able to achieve.

If you already created a new extent-of-damage classification before (see above) it will be availiable here. At the top of the page you can switch between the two classifications. In the Screenshot below, we used the example of a "standard" and a "Data protection"(Datenschutz) calssification. You can add new benefit classes with the plus button.

Example: Benefit Sehr groß

Monetary benefit:

Here you may define how high the monetary benefit of a class is.

Opportunity factor:

The opportunity factor is th opposite of the risk factor. It also serves as a multiplier for calculating the risk indicator of an opportunity. Since the opportunity factor is negative, the resulting risk indicator is negative as well.

The risk indicator serves to rank the risks and opportunities. The higher the risk ratio (meaninng, the further away from zero), the greater the significance of the opportunity.

Add criterion:

Here the criteria already created can be mapped to a benefit class. Furthermore, in the context of the class it should be described what kind of benefit must occur to fulfill a criterion.

Protection target synonyms

This item is only relevant for you if you have created a second extent-of-damage classification under Risk policy > Extents of damage and want to use it. The menu item is only visible if at least two extent-of-damage classifications exist.
Since the same protection targets can have different names in different classifications, it is possible to specify specific names of protection targets for the respective classifications. For example, the protection target "Confidentiality" in the context of the data protection classification can be called “Privacy” in the context of data protection (see screenshot). As a result, wherever the protection target is used, the protection target synonym of the extent-of-damage classification of the Data Protection management system — i.e. the designation "Privacy" — is displayed.

Protection target synonyms

Protection requirement

The protection requirement of an asset (a resource or a data category) indicates how critical the asset is to the organization. Protection needs classes can be created and managed by administrators or experts under “Risk Management → Risk Policy → Protection Requirements”.

Example: Protection requirement High

The range on the percentage bar controls the allocation of protection needs classes: In HITGuard, the protection needs class is based on the degree of dependency stored in the dependency relationship in the structure analysis. This value usually comes from a protection needs analysis via the PNA edge weight. Depending on the level of your PNA edge weight, the previously defined extent-of-damage classes fall into different protection needs classes (see also above under extents of damage). You can define an individual range of percentage values for each protection needs class, which will then react to the respective PNA edge weights.

In the structural analysis, HITGuard determines, for each asset (resource or data category), the edge dependency as a percentage with the highest PNA edge weight value across all incoming protection target relationships. It then uses the specified range to determine the corresponding protection requirement class.

The color is used to depict the protection needs class in the structural analysis and in grids. Critical assets should receive colors like red, which allow all users to intuitively recognize them as important.

Examples for protection needs classes:

• Normal: The damage effects are limited and manageable (0-30% PNA edge weight).
• High: The damage effects can be considerable (30-70% PNA edge weight).
• Very high: The damage effects can reach an existentially threatening, catastrophic magnitude (70-100% PNA edge weight).

Risk matrix

The risk matrix results from the combination of extent-of-damage or benefit classes (vertical) and probability of occurrence classes (horizontal). In the respective cells of the matrix, the corresponding risk factors are multiplied to obtain the risk indicator, called the risk ratio or opportunity ratio. The higher the risk ratio, the more critical a risk is and the more urgently it should be addressed to prevent serious consequences. The lower the opportunity ratio (i.e. the further into the negative range it reaches), the greater the opportunity and the more it should be exploited to generate profit. In the dashboard, risks are often ranked according to the risk ratio, e.g. in the KPI Top Risks/Opportunities.

Once you have selected a cell with a click, you can assign a color to it using the settings below the matrix. This allows you to control the color in which HITGuard displays such a risk in various KPIs and in the structure analysis. The colors should be based on the risk ratios, i.e. you should only use a color above or below a specific value. Otherwise, this may lead to ambiguities later during evaluation. The more critical and urgent a risk is, the more alarming the color should be.

If you have created a second extent-of-damage classification under Risk policy > Extents of damage (see above), a second risk matrix will also be created here. You can configure it with its own colors, which will then be used to mark the risks in the management system that uses this classification. Note: To use a new classification in a management system, you must assign it under Risk management > Settings.

Example: risk matrix

Warning! The size of the risk matrix must be fully configured before you begin working in the system. This concerns the number of probabilities of occurrence and extent-of-damage classes. Names, colors, criteria, and other settings can still be adjusted later, but the number of classes cannot.

Data classes

The data classification specifies how data is to be handled, depending on your classification. This depends on the confidentiality of the data and the corresponding desired level of protection.

The number of categories, the name of the data class and its description are freely definable. A new class can be created using the "Plus" button.

Example: the class "Streng vertraulich"(hihgly confidential)

You can also specify what extent of damage would occur if data of this classification were disclosed. To do this, you can select the corresponding extent of damage from the drop-down below. If multiple extent-of-damage classifications exist, you must ensure that you select the correct classification.

Note: If a data class is assigned to an extent of damage, the extent of damage cannot be deleted. If you cannot delete an extent of damage during the initial setup of HITGuard, it is usually because a data class is still linked to that extent of damage. If you change the assignment of the data class, the extent of damage can be deleted. Later, when other elements (e.g. a risk) use the extent of damage, it can no longer be deleted at all. Example:

Data classes	Damage extent class
Public	Very Low (Default)
Internal	Medium (default)
Confidential	Large (default)
Secret	Very Large (default)

Abilities to control

The abilities to control are used to evaluate the quality of the risk treatment measures and controls that have already been implemented for a risk. More about the context of their application can be found here.

Here in the risk policy, you can manage the available abilities to control used for evaluation. A new ability to control can be created using the "Plus" button. Existing ones can be deleted using the "Trash" button.

The following abilities to control are offered by default:

• nicht relevant | not relevant - The ability to control the risk with the assigned set of measures and controls is not relevant.
• initial | initial - The ability to control the risk with the assigned set of measures and controls is in an early state of development.
• gemanagt | managed - The ability to control the risk with the assigned set of measures and controls can done successfully.
• definiert | defined - The ability to control the risk with the assigned set of measures and controls is reproducible and can be handled with an adapted standard process.
• gemessen | measured - The ability to control the risk with the assigned set of measures and controls is measurable with a statistical control.
• optimiert | optimized - The ability to control the risk with the assigned set of measures and controls is measurable with a statistical control and can improve the modus operandi.

These classes are recommendations and can be edited by Expert users; they are only available in German in the tool.

Abilities to control

Categories of risks/opps and impacts

Here you can define categories to manage identified risks and opportunities. With these categories, you can later filter in the grid or restrict the view of a KPI to the risks or opportunities within a specific category.

Risk policy → Categories of risks/opportunities and impacts

Using the "Plus" button, new categories can be created. They can be renamed at any time. Only categories that are not already used in an element (risk, opportunity, or impact) can be deleted. For categories that are already assigned, the "Delete" button is deactivated.

Categories or risks/opps

Individual Risks, Opportunities and Impacts can have one or more categories assigned and may be grouped accordingly.

Criteria for impacts

Example: Criteria for impacts

Impacts only play a role in the add-on module “ESG”. HITGuard offers you the option to freely configure criteria for impacts. These criteria can in turn be assigned to impacts in order to label or categorize them.

Classifications for impacts

Impact classes

Impact classes describe the scale, the scope, and the remedy (in the case of negative impacts) of an impact. They are used to evaluate positive and negative impacts on the company from external sources and outward effects caused by the company. Additional details about individual impacts can be captured using criteria.

Impact classes can be defined for each of the three classifications.

Add criterion:

Here the criteria already created can be mapped to an impact class. Furthermore, in the context of the class it should be described what kind of circumstance must occur to fulfill a criterion.

Impact factor:

The impact ratio is calculated from the impact factors of the impact classes and the risk factor of the probability of occurrence. Like the risk ratio, it shows how big or small an impact is by a company on its environment.