1 review due: Phishing takes over an admin console account.
| Risk | Area | Score | Treatment | Owner | Status |
|---|---|---|---|---|---|
| A third-party library ships an exploitable flawKestrel Gateway | e | 16residual 9 | Mitigateby 2026-12-28 | Jonas Weber | Open |
| Ransomware reaches the firmware build serverKestrel Gateway | c | 15residual 8 | Mitigateby 2026-12-13 | Ines Brandt | Being treated |
| Phishing takes over an admin console accountKestrel Cloud Console review due | j | 12residual 4 | Mitigate | Ines Brandt | Treated |
| Support staff export customer data by mistakeCustomer support portal | g | 9 | Mitigateby 2026-11-27 | Jonas Weber | Open |
| Cloud host outage takes the console downKestrel Cloud Console | c | 6 | Accept | Board | Accepted |
Likelihood × impact
open risks| L \ I | 1 | 2 | 3 | 4 | 5 |
|---|---|---|---|---|---|
| 5 | · | · | · | · | · |
| 4 | · | · | · | 1 | · |
| 3 | · | · | 1 | 1 | 1 |
| 2 | · | · | 1 | · | · |
| 1 | · | · | · | · | · |
NIS2 Article 21(2) areas
- (a) Risk analysis and information system security policies none recorded
- (b) Incident handling none recorded
- (c) Business continuity, backups, disaster recovery, crisis management 2
- (d) Supply chain security none recorded
- (e) Secure acquisition, development and maintenance; vulnerability handling and disclosure 1
- (f) Assessing the effectiveness of the measures none recorded
- (g) Basic cyber hygiene and cybersecurity training 1
- (h) Cryptography and encryption none recorded
- (i) Human resources security, access control and asset management none recorded
- (j) Multi-factor authentication and secured communications 1
"None recorded" means no open risk is filed under that measure here. Whether your measures are appropriate and proportionate is your organization's judgment; the register records it.