YOMA_ToIP Risk Assessment Worksheet _October 2021.xlsx

	A	B	C	D	E	F	G	H	I	J	K	L
1
2		Risk Assessment Worksheet
3
4	No.	RISK	ToIP LAYER	Yoma Values	TRUST AREAS AFFECTED	SEVERITY	LIKELIHOOD	RISK IMPACT	RISK CONSIDERATION ACTIONS	RISK TREATMENT	RISK TREATMENT ACTIONS	RESIDUAL RISK

5		Administering Authority Risks
6		Lack of competence to perform role	Ecosystem	Trust	Governance	4	5	HIGH	Need for experienced personnel, proper training and governance framework	Acceptance	There is no GA, however there IS a mechanism in REVISIONS section of the GF for changing and updating the GF which is managed by the Administering Authority
7		Lack of a dispute resolution process	Ecosystem	Trust	Governance	4	1	LOW-MEDIUM	Need for a mechanism for complaints and dispute resolution within the Yoma community (ie when it is not a matter of breaking law e.g. a contract)	Avoidance	Added to the Governance Framework - ADR process in governance requirements controlled document
8		Lack of sufficient policy and practices	Ecosystem	Trust	Governance	2	3	LOW-MEDIUM	Need for complete governance framework and revisions schedule	Avoidance	GF written and includes revisions section, already have key practices in place (e.g. privacy policy)
9		Lack of consistency in operating practices of roles, especially in transition between taskforce, interim GA and new yoma entities in the future	Ecosystem	Community	Governance	4	3	MEDIUM	Requires proper oversight and trust assurance mechanisms	Other	Clauses in the GF which include a requirement on the AA and the YPM to carry out 6 monthly risk assessment process and to have in place a data breach emergency plan.
10		Lack of accountability of roles in network	Ecosystem	Community	Governance	5	2	MEDIUM	Requires proper oversight and trust assurance mechanisms	Other	Resolved partly because all participants have a role as a Yoma Member alongside other roles therefore offering consistent set of rights and duties to eachother. Also RA process requirements
11		Lack of communication about governance practices	Ecosystem	Trust	Governance	2	2	LOW-MEDIUM	Requires appropriate communication channels	Avoidance	Within GF there are requirements to publish including related to revisions and extensions, also the GF itself clearly publishes the policies & practices
12		Lack of appropiate authority (For Interim GF, there is no GA)	Ecosystem	Trust	Governance	2	2	LOW-MEDIUM	Requires recognition and endorsement by relying parties	Other	Already have administering authority & YPO and mechanisms for changing the GF - therefore AA should be all that is necessary
13		Ineffective bias in authority	Ecosystem	Fairness	Governance	3	2	LOW-MEDIUM	Requires even representation, voting standards and non-discrimination practices	Avoidance	All parties become Yoma members, all are therefore subject to common rules of the game.
14		Lack of Relying Party (Any entity within the yoma ecosystem, subject to the Yoma Governance Framework) recognition	Ecosystem	Trust	Governance	4	3	MEDIUM	Requires recognition and endorsement by relying parties	Acceptance	In future a Trust Registry may be put in place, until then mitigations from local yoma community growth approach
15		Ecosystem Lacks Jurisdictional Acceptance	Ecosystem	Trust	Governance	1	1	LOW	Requires Mapping of Jurisdictional Regulation	Avoidance	Has been accepted and operational in SA since 2020
16		Ecosystem Lacks Industry Acceptance	Ecosystem	Personal Self-Development	Governance	2	1	LOW	Requires Mapping of Industry Regulation	Acceptance	Not really a risk for Yoma
17		Ecosystem Issues Trust Marks Inappropriately or Without Basis	Ecosystem		Governance				Requires Adequate Trust Marks Policies
18		Ecosystem Allowing Inappropriate Actors to Participate in Network	Ecosystem	Trust	Governance	4	3	MEDIUM	Requires Provider Evaluation and Acceptance Processes	Avoidance	Current mitigation is small group of trusted partners, accept this risk because access for youth participants is the priority
19		Ecosystem Inappropriately Blacklisting or White Listing Other Ecosystems	Ecosystem	Community	Governance	2	2	LOW-MEDIUM	Requires Adequate Ecosystem Black and White Listing Processing	Avoidance	Clear Revisions & Extensions policy and process which includes Yoma community review and pubic review cycles
20		Issuer Risks (Opportunity Provider, yoma platform operator)
21		Credential Issued without sufficient basis	Credential	Trust	Data Integrity	5	2	MEDIUM	Requires training, trust assurance practices and controlled practices	Transference	Currently all credential issuance carried out by Yoma platform
22		Credential Issued before appropriate proofing of basis	Credential	Trust	Data Integrity	5	1	LOW-MEDIUM	Requires training, trust assurance practices, controlled practices and proper workflow	Acceptance
23		Credential Issued in the wrong format or structure	Credential	Trust	Data Integrity	5	1	LOW-MEDIUM	Requires standard formats and formatting controls	Acceptance
24		Credential issued to impostors	Credential	Trust	Security	5	4	HIGH	Requires Trusted Issuers, trust assurance practices	Acceptance	Plan is that they will have in the future with some ID&V issued with Yoma Member Credential. Thereafter will just be the Opportunity Provider to issue to the correct individuals.
25		Credential Lacking Uniqueness	Credential	Personal Self-Development	Data Integrity			LOW	Requires Appropriate Credential Searialization	Acceptance
26		Credential Becoming Obsolete	Credential	Personal Self-Development	Data Integrity	3	4	MEDIUM	Requires Appropriate Credential Validity Periods	Acceptance
27		Lack of Credential Revocation	Credential	Fairness	Data Integrity	5	5	HIGH	Requires Adequate Credential Status Checking Procedures	Acceptance	Implement revocation
28		Identity Proofing Practices Inadequate for Level of Assurance	Credential	Trust	Data Integrity			LOW	Requires Ecosystem Governance Conformance Procedures	Acceptance
29		Issuer Practices Not Accepted by Ecosystem	Ecosystem	Trust	Governance	1	1	LOW	Requires Issuer Practice Conformance Procedures	Avoidance	In future Issues will be verified before being accepted as opportunity providers int he system. Issuer and Verifier registry to be created in the future. Currently Yoma Platform Operator are only issuer
30		Issuer Operations Unavailable	Credential	Trust	Availability	2	3	LOW-MEDIUM	Requires Network Redundancy Procedures	Acceptance
31		Verifier Risks (Employment Opportunity Provider, Token Provider)
32		Lack of competence to perform role	Credential	Trust	Governance	4	5	HIGH	Need for experienced personnel, proper training and governance framework	Acceptance	Develop training / information for verifiers
33		Lack of consistent verification practices	Credential	Fairness	Data Integrity	4	4	MEDIUM-HIGH	Requires training, trust assurance practices and controlled practices	Acceptance	Without LEI as part of issuer on-boarding process risks around issuer reliability
34		Missing verification	Credential	Trust	Data Integrity			LOW	Requires training, trust assurance practices and controlled practices	Acceptance
35		Untimely verification	Credential	Trust	Data Integrity	2	4	MEDIUM	Requires time-based controls	Acceptance
36		Evidence of verification incomplete or in incorrect format	Credential	Personal Self-Development	Data Integrity			LOW	Requires standard formats and formatting controls	Acceptance
37		Verifier Practices Not Accepted by Ecosystem	Ecosystem	Trust	Governance	5	2	MEDIUM	Requires Verifier Conformance Procedures	Avoidance	No verifiers at present
38		Suspended Credential Being Accepted N/A	Credential	Trust	Data Integrity	5	4		Requires Adequate Credential Suspension Processes
39		Revoked Credential Being Accepted	Credential	Trust	Data Integrity	3	4	MEDIUM	Requires Adequate Credential Status Checking Procedures	Acceptance
40		Man-In-The_middle Attack During Legitimate Verification	Credential	Trust	Security			LOW	Requires Verifier Vulnerability Practices	Acceptance
41		Verifier Network Unavailable	Credential	Trust	Availability	2	4	MEDIUM	Requires Network Redundancy Procedures	Acceptance
42		Authoritative Issuer Registry Risks						LOW
43		Lack of competence to perform role (Resources; validation and issuer on-boarding, revalidation) Human resources & business processes.	Credential	Trust	Governance	3	5	MEDIUM-HIGH	Requires Issuer Practice Conformance Procedures	Avoidance	Using common standards that although innovative are not risky tech and performed by competent individuals in YPO
44		Unavailable registry	Credential	Trust	Availability	3	5	MEDIUM-HIGH	Requires availability controls	Acceptance	Implement Trust Registries
45		Lack of appropriate access to registry	Credential	Fairness	Security	3	5	MEDIUM-HIGH	Requires appropriate access controls	Acceptance	Implement Trust Registries
46		Inapproriate access writes to registry	Credential	Fairness	Data Integrity	3	5	MEDIUM-HIGH	Requires appropriate access management controls	Acceptance	Implement Trust Registries
47		Breach of registry	Credential	Trust	Security	5	5	HIGH	Requires appropriate security perimeter, breach detection and notification controls	Acceptance	Implement Trust Registries
48		Exploited Use of Stolen Credentials	Credential	Trust	Data Integrity	5	5	HIGH	Requires Adequate Breach Notifiaction Processes	Acceptance	Implement Trust Registries
49		Credential Registry Not Accepted by Ecosystem	Ecosystem	Personal Self-Development	Governance	5	2	MEDIUM	Requires Credential Verifier Conformance Procedures	Avoidance	Added Trust Registry requirements to information trust requirements controlled document
50		Authoritative Schema Registry Risks
51		Lack of competence to perform role	Credential	Trust	Governance	3	2	LOW-MEDIUM	Requires Issuer Practice Conformance Procedures	Avoidance	Using common standards that although innovative are not risky tech and performed by competent individuals in YPO
52		Unavailable registry	Credential	Trust	Availability			LOW	Requires availability controls	Acceptance	Implement Trust Registries
53		Lack of appropriate access to registry	Credential	Trust	Security			LOW	Requires appropriate access controls	Acceptance	Implement Trust Registries
54		Inapproriate access writes to registry	Credential	Trust	Data Integrity			LOW	Requires appropriate access management controls	Acceptance	Implement Trust Registries
55		Breach of registry	Credential	Trust	Security			LOW	Requires appropriate security perimeter, breach detection and notification controls	Acceptance	Implement Trust Registries
56		Exploited Use of Stolen Credentials	Credential	Trust	Data Integrity			LOW	Requires Adequate Breach Notifiaction Processes	Acceptance	Implement Trust Registries
57		Credential Registry Not Accepted by Ecosystem	Ecosystem	Personal Self-Development	Governance	4	2	MEDIUM	Requires Credential Verifier Conformance Procedures	Acceptance	Implement Trust Registries, added to the GF
58		Credential Registry Risks (Out of current Scope)
59		Lack of competence to perform role	Credential	Trust	Governance			LOW	Requires training, trust assurance practices and controlled practices	Acceptance
60		Unavailable registry	Credential	Trust	Availability			LOW	Requires availability controls	Acceptance
61		Lack of appropriate access to registry	Credential	Trust	Security			LOW	Requires appropriate access controls	Acceptance
62		Inapproriate access writes to registry	Credential	Trust	Data Integrity			LOW	Requires appropriate access management controls	Acceptance
63		Breach of registry	Credential	Trust	Security			LOW	Requires appropriate security perimeter, breach detection and notification controls	Acceptance
64		Exploited Use of Stolen Credentials	Credential	Trust	Data Integrity			LOW	Requires Adequate Breach Notifiaction Processes	Acceptance
65		Credential Registry Not Accepted by Ecosystem	Ecosystem	Trust	Governance			LOW	Requires Credential Verifier Conformance Procedures	Acceptance
66		Audit Accreditor Risks
67		Insufficient vetting of auditor population	Ecosystem	Trust	Governance			LOW	Requires training, and generally accepted auditor accreditor practices	Acceptance
68		Lack of competence to perform role	Ecosystem	Trust	Governance			LOW	Requires training, and generally accepted auditor accreditor practices	Acceptance
69		Auditor Risks
70		Lack of competence to perform role	Ecosystem	Trust	Governance			LOW	Requires training, sufficient experience and generally accepted auditor practices	Acceptance
71		Credential Holder Risks (Yoma Members)
72		Holder Threat of Litigation over Issuer	Credential	Community	Confidentiality	1	1	LOW	Proper Agreement in pace between Issuer and Holder detailing rights.	Acceptance
73		Counterfeit Credentials Being Created	Credential	Trust	Data Integrity	5	1	LOW-MEDIUM	Requires Adequate Credential Non-Repudiation Practices	Acceptance
74		Lack of Binding Between Holder and Credential	Credential	Trust	Data Integrity			LOW	Requires Adequate Wallet Protection Measures	Acceptance
75		Credential Holder Given Inappropriate Access Rights	Credential	Trust	Security	5	1	LOW-MEDIUM	Requires Adequate User Enrolment Processes	Acceptance
76		Imposter Using Valid Credential	Credential	Trust	Security	5	4	HIGH	Requires Adequate Wallet Protection Measures	Transference	Consider implementation of wallet compromise measures (e.g. private key rotation)
77		Credential Wallet Private Key is Compromised	Credential	Trust	Security	5	5	HIGH	Requires Adequate User Wallet Protection Measures	Transference	Consider implementation of wallet compromise measures (e.g. private key rotation)
78		Credential Holder's Private Data is Compromised	Credential	Trust	Privacy	5	5	HIGH	Requires Adequate User Wallet Protection Measures	Transference	Consider implementation of wallet compromise measures (e.g. private key rotation)
79		Lack of Portability of Credential	Credential	Personal Self-Development	Data Integrity	5	3	MEDIUM-HIGH	Requires Adequate Credetial Interoperability Practices	Transference	Credential Standards specified in GF Technical Requirements Controlled document
80		Lack of Credential Federation Across Ecosystems	Ecosystem	Community	Governance	4	3	MEDIUM	Requires Adequate Credetial Interoperability Practices	Avoidance	Interoperability rules for standards at layer 3 in GF
81		Exploited Private PIN Code Capture	Credential	Privacy	Confidentiality	5	2	MEDIUM	Requires Adequate Wallet Protection Measures	Acceptance	Currently Cloud Wallet - always have a cloud wallet option with appropriate security controls
82		Social Engineering Attacks Sucessfully Gather Credentials by Perpetrators	Credential	Privacy	Security	5	2	MEDIUM	Requires Adequate Wallet Protection Measures	Acceptance	Currently Cloud Wallet - always have a cloud wallet option with appropriate security controls
83		Provider Risk
84		Provider Software Does not Operate as Intended	Provider	Trust	Data Integrity	2	2	LOW-MEDIUM	Requires Adequate Provider SDLC Processes	Acceptance	Remove reliance on external TPs
85		Provider Software Does Not Operate on User Devices	Provider	Trust	Data Integrity	2	3	LOW-MEDIUM	Requires Adequate Provider SDLC Processes	Acceptance	Remove reliance on external TPs
86		Provider Code Updates Cause Operational Issues	Provider	Trust	Data Integrity	4	3	MEDIUM	Requires Adequate Provider SDLC Processes	Acceptance	Remove reliance on external TPs
87		Provider System Unavailable	Provider	Trust	Availability	5	2	MEDIUM	Requires Adequate Provider Hardware Integration Practices	Acceptance	Remove reliance on external TPs
88		Utility Risks
89		Inconsistent Steward Acceptance Practices	Utility	Privacy	Governance	3	2	LOW-MEDIUM	Requires Adequate Utliity Steward Aceptance Practices	Acceptance	Communication & Alignment with Ulility Providers
90		Stewards Not Abiding by Governance Practices	Utility	Trust	Governance	4	2	MEDIUM	Requires Adequate Steward Conformance Practices	Acceptance	Communication & Alignment with Ulility Providers
91		Stewardship Not Available to Qualified Applicants	Utility	Fairness	Governance	2	4	MEDIUM	Requires Adequate Utliity Steward Aceptance Practices	Acceptance	Communication & Alignment with Ulility Providers
92		Utility Not a Viable Going Concern	Utility	Trust	Governance	5	1	LOW-MEDIUM	Requires Adequate Utility Monitoring Practices	Acceptance	Communication & Alignment with Ulility Providers
93		Utility Using an Ineffective Consensus Model	Utility	Trust	Governance	5	1	LOW-MEDIUM	Requires Adequate Utility Monitoring Practices	Acceptance	Communication & Alignment with Ulility Providers
94		Utility Consensus Model Not Operating as Designed.	Utility	Trust	Governance	3	1	LOW	Requires Adequate Utility Monitoring Practices	Acceptance	Communication & Alignment with Ulility Providers
95		Utility Charging Inaccurate Fees For Service	Utility	Fairness	Governance	3	2	LOW-MEDIUM	Requires Adequate Utility Monitoring Practices	Acceptance	Communication & Alignment with Ulility Providers
96		Inadequate Number of Stewards for Consensus Protocol	Utility	Trust	Governance	5	1	LOW-MEDIUM	Requires Adequate Utility Monitoring Practices	Acceptance	Communication & Alignment with Ulility Providers
97		Inadequate Infrastructure Supporting Steward Operations	Utility	Trust	Availability	4	1	LOW-MEDIUM	Requires Adequate Steward Conformance Practices	Acceptance	Communication & Alignment with Ulility Providers
98		Inadequate Network Throughput Supporting Steward Operations	Utility	Trust	Availability	2	1	LOW	Requires Adequate Steward Conformance Practices	Acceptance	Communication & Alignment with Ulility Providers
99		Inadequate Network Availability Supporting Steward Operations	Utility	Trust	Availability	3	1	LOW	Requires Adequate Steward Conformance Practices	Acceptance	Communication & Alignment with Ulility Providers
100