| Document Number | SOP-GL-COM-RISKA-V1.0 |
| Target audience | LEAP -All |
| Effective Date |
Cover page layout
LEAP Legal Software performs information security risk assessments to identify, evaluate, and manage risks that may impact business objectives, operations, assets, individuals, customers, and regulatory obligations.
This risk assessment process is aligned with NIST Special Publication 800‑30 and establishes a consistent approach to identifying threats, vulnerabilities, impacts, and likelihoods. The outcomes of this process support risk‑based decision making, prioritisation of mitigation activities, and ongoing risk management.
This SOP applies to all information systems, business processes, services, and assets owned, operated, or managed by LEAP Legal Software, including third‑party services where LEAP has security or contractual accountability.
The risk assessment process applies to:
This SOP applies to all LEAP Legal Software personnel involved in risk identification, assessment, decision making, and risk treatment.
| Common Terms | Definitions |
|---|---|
| Risk | A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. |
| Risk Assessment | The process of identifying, estimating, and prioritizing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system. |
| Risk Assessor | The individual, group, or organization responsible for conducting a risk assessment. |
| Information Security Risk | The risk to organisational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation due to the potential for unauthorized access, use, disclosure, disruption, modification, or destruction of information and/or information systems. |
| Risk Response | Accepting, avoiding, mitigating, sharing, or transferring risk to organizational operations (i.e., mission, functions, image, or reputation), organizational assets, individuals, other organizations |
| Management Controls | The security controls (i.e., safeguards or countermeasures) for an information system that focus on the management of risk and the management of information system security. |
| Inherent Risk | Inherent risk is the level of risk before the application of any controls or mitigations |
| Residual Risk | Portion of risk remaining after security measures have been applied. |
Table 1: Key Definitions :
| Role | Responsibility |
|---|---|
| Leadership Team | Serves as Risk Approvers with authority to approve risk treatment decisions, risk acceptance, and resource allocation for risk mitigation activities. Reviews and approves enterprise-level risk strategies. |
| Governance, Risk and Compliance (GRC) | Primary Risk Assessors responsible for conducting risk assessments, maintaining the risk register (VANTA), developing risk treatment plans, and monitoring risk mitigation activities. Communicates risk status to leadership and coordinates risk management activities across the organization. |
| Chief Information Officer | Can approve the avoidance, remediation, transference, or acceptance of any risk cited in the Risk Register. Oversees technology-related risk management initiatives. |
| Engineering Team | Serves as Risk Owners for technical risks related to software development, system architecture, security implementations, and technology infrastructure. Responsible for implementing technical risk controls and mitigation measures. |
| Operations Team | Serves as Risk Owners for operational risks related to service delivery, business processes, vendor management, and day-to-day operations. Responsible for implementing operational risk controls and ensuring business continuity. |
| IT Security / Systems Engineer | Shall be responsible for the identification and treatment plan development of all Information Security related risks. This person shall be responsible for communicating risks to top management and adopting risk treatments in accordance with executive direction. |
| All staff | Identifying, managing and escalating (where applicable) risk in day-to-day operations. |
Table 2: Roles and Responsibilities
Risk assessment is implemented through the LEAP Risk register in VANTA. The risk assessment process is coordinated by the Risk Owner, identification of threats and vulnerabilities is performed by asset owners or their delegated personnel, and assessment of Impact and likelihood is performed by risk owners or their delegated personnel. Each risk within the register is represented by a unique risk ID and relevant date stamps such as the date the risk was identified and the date of implementation.
In addition, Risk Assessment takes references from security and compliance frameworks like ISO 27001:2022, SOC 2 Type 2, GDPR and GDPR.
The purpose of this step is to identify and evaluate information security risks to LEAP Legal Software and to prioritise them based on risk level.
Likelihood: is the frequency with which a risk may occur. The definitions of the categories for likelihood are set out below. This is a qualitative measure and generally uses subjective assessment of the occurrence of the risk.
| LIKELIHOOD LEVEL | LIKELIHOOD DESCRIPTION | RATING (NUMERICAL) |
|---|---|---|
| Very unlikely (1) | A threat event is so unlikely that it can be assumed that its occurrence may not be experienced. A threat source is not motivated or has no capability, or controls are in place to prevent or significantly impede the vulnerability from being exploited. |
1 |
| Unlikely (2) | A threat event is unlikely, but there is a slight possibility that its occurrence may be experienced. A threat source lacks sufficient motivation or capability, or controls are in place to prevent or impede the vulnerability from being exploited. |
2 |
| Somewhat likely (3) | A threat event is likely, and it can be assumed that its occurrence may be experienced. A threat source is motivated or poses the capability, but controls are in place that may significantly reduce or impeded the successful exploitation of the vulnerability. |
3 |
| Likely (4) | A threat event is likely, and it can be assumed that its occurrence will be experienced. A threat source is highly motivated or poses sufficient capability and resources, but some controls are in place that may reduce or impede the successful exploitation of the vulnerability. |
4 |
| Very likely (5) | A threat event is highly likely, and it can be assumed that its occurrence will be experienced. A threat source is highly motivated or poses sufficient capability or resources, but no controls are in place or controls that are in place are ineffective and do not prevent or impede the successful exploitation of the vulnerability. |
5 |
Table 3: Likelihood Criteria
| IMPACT LEVEL | IMPACT DESCRIPTION | RATING (NUMERICAL) |
|---|---|---|
| Very low impact (1) | A threat event could be expected to have almost no adverse effect on organizational operations, mission capabilities, assets, individuals, customers other or organizations | 1 |
| Low impact (2) | A threat event could be expected to have a limited adverse effect, meaning: degradation of mission capability yet primary functions can still be performed; minor damage; minor financial loss; or range of effects is limited to some cyber resources but no critical resources. | 2 |
| Medium impact (3) | A threat event could be expected to have a serious adverse effect, meaning: significant degradation of mission capability yet primary functions can still be performed at a reduced capacity; minor damage; minor financial loss; or range of effects is significant to some cyber resources and some critical resources. | 3 |
| High impact (4) | A threat event could be expected to have a severe or catastrophic adverse effect, meaning: severe degradation or loss of mission capability and one or more primary functions cannot be performed; major damage; major financial loss; or range of effects is extensive to most cyber resources and most critical resources. | 4 |
| Very high impact (5) | A threat event could be expected to have multiple severe or catastrophic adverse effects on organizational operations, assets, individuals, other organizations, or the Nation. Range of effects is sweeping, involving almost all cyber resources. | 5 |
Table 4: Impact Creteria
By entering the values of Impact and likelihood into the Risk Assessment register, the level of risk is calculated automatically by multiplying the two values. The resultant is analysed based on the following 5 X 5 matrix.
| RISK= LIKELIHOOD X IMPACT | LIKELIHOOD | ||||
|---|---|---|---|---|---|
| IMPACT | Very unlikely: 1 | Unlikely: 2 | Somewhat likely: 3 | Likely: 4 | Very likely: 5 |
| Very high impact: 5 | 5 | 10 | 15 | 20 | 25 |
| High impact: 4 | 4 | 8 | 12 | 16 | 20 |
| Medium impact: 3 | 3 | 6 | 9 | 12 | 15 |
| Low impact: 2 | 2 | 4 | 6 | 8 | 10 |
| Very low impact: 1 | 1 | 2 | 3 | 4 | 5 |
Table 5: Risk Matrix
| RISK LEVEL | RISK DESCRIPTION |
|---|---|
| Low (1-4) | A threat event could be expected to have a limited adverse effect on organizational operations, mission capabilities, assets, individuals, customers, or other organizations. |
| Medium (5-12) | A threat event could be expected to have a serious adverse effect on organizational operations, mission capabilities, assets, individuals, customers, or other organizations |
| High (15-25) | A threat event could be expected to have a severe adverse effect on organizational operations, mission capabilities, assets, individuals, customers, or other organizations. |
Table 6: Risk Level
According to the above tables, and with the consultation of the stakeholders, each risk is mitigated with controls relevant to the business needs and constraints. The controls decided for each risk and the details of their implementation are recorded in the risk treatment plan.
The responses to risk will utilize some or all of the following risk treatment options:
Exceptions in this SOP will be risk-assessed by LEAP's CISO or relevant Executive, with valid business justification and SOP Owner's approval. Exceptions will be time bound.
On-going monitoring of the risks is a critical factor in the LEAP Risk Management SOP. This is to ensure on results achieved at each step, re-assess the risk if necessary, and the priorities adjusted, if required.
Ongoing review is essential to ensure that the Risk Treatment Plan remains relevant. Thus, it is necessary to review the risk assessment annually and in the event that severe changes occur to the organisation.
The Manager of Governance, Risk, and Compliance will own the document and present the results of risk assessment and risk treatment, and all of the subsequent reviews to the leadership.
Communication is an important consideration at each step of the risk assessment process. Effective communication between stakeholders is essential to ensure that risks are understood and decisions about risk response selection are appropriate.
The Manager of Governance, Risk, and Compliance will facilitate communication between all stakeholders identified for a particular risk as deemed appropriate by the Leadership.
| Version Number | Date | Section Changes | Author | Approver |
|---|---|---|---|---|
| 1.0 | 20/4/2026 | Initial Release | Manager of GRC | CISO |