4. Risk Management Framework
4.1 Risk Management Policy
OpenRemote applies a structured risk management approach to identify, analyse, and mitigate risks that may affect the organisation’s operations, information assets, or service delivery. Risk management is integrated into organisational planning, product development, and operational decision-making.
Risks are assessed based on their likelihood and potential impact on confidentiality, integrity, availability, and business continuity. Identified risks are documented and prioritised, and mitigation actions are defined and tracked until completion in a risk management register (see section 16).
4.2 Asset Inventory
OpenRemote maintains an inventory of information assets that support its services and operations. Assets include infrastructure components, software systems, repositories, cloud services, and organisational information resources.
Each asset is assigned an owner responsible for maintaining its security and operational status. The inventory helps ensure that security controls, monitoring, and risk management activities are applied consistently across all critical systems.
4.3 Risk Assessment Methodology
The organisation applies a consistent methodology to evaluate risks affecting its systems and services. Risks are identified through periodic reviews of operational processes, infrastructure components, and external threat intelligence.
For each risk, the likelihood of occurrence and potential impact are assessed. The resulting risk score determines the priority for mitigation. Risk assessments are reviewed periodically and whenever significant system or organisational changes occur.
4.4 Risk Treatment Plan
For each identified risk, an appropriate treatment strategy is defined. Possible strategies include mitigating the risk through security controls, transferring the risk through contractual arrangements, accepting the risk when it falls within acceptable levels, or avoiding the risk entirely.
Risk treatment actions are documented in the risk register and assigned to responsible owners. Progress on mitigation activities is monitored and reviewed during management meetings.
4.5 Statement of Applicability
The Statement of Applicability (SoA) identifies which security controls from ISO27001 (Annex A) are applicable to OpenRemote and describes how these controls are implemented. Controls that are not applicable are documented together with their justification.
The SoA provides a reference linking implemented controls to the organisational processes described in this handbook and serves as an important reference during internal and external audits.