A checklist for threats (risks) according to the MAPGOOD method

It is often difficult to identify threats or risks for your own organization from scratch. This is a requirement for the new versions of standards of management systems such as ISO 9001, ISO 14001 and ISO 27001. A commonly used method is the so-called MAPGOOD method. MAPGOOD stands for People, Equipment, Software, Data, Organization, Environment and Services. These are the different angles to look at threats and risks. The identified risks are then compared to the established underwriting criteria. If the risks do not meet the set acceptance criteria, appropriate measures must be taken: avoid, reduce/mitigate, transfer or accept.

The table below (MAPGOOD item / failure mode / threat) is a tool to map out the threats (risks) for your own organization from a generic threat perspective.

MAPGOOD - GRC challenge

A standard list of all threats is included in the Metaware management system platform. In which we manage our risks, just like for the methods Risk Analysis Municipalities, RISMAN, RAVIB or NIS2. The measures to reduce the risks (mitigation) are set out in a control framework.

Seen in a broader context, MAPGOOD is a practical method for a risk analysis, but it revolves around the GRC challenge - Governance-Risk-Compliance: the integrated management of policy, risks and compliance within an increasingly complex regulatory landscape.

New: In collaboration with our colleagues at meta-audit.nl , we provide a certifiable sample ISMS incl. MAPGOOD risks in accordance with ISO27001:2022 or NEN7510:2024 . Click here for a more detailed explanation.

[click on image for demo]

Standard risks

A standard list of all threats as contained in the Metaware management system platform .

Man	Functions incorrectly Not present Not employed	*Drop:* - Foreseeable (dismissal, vacation) - Unforeseeable (illness, death, accident, strike)



		*Unintentional misconduct:* - Ignorance, sloppiness - Faulty procedures - Complex error-prone operation - Careless .....






		*Intentional misconduct:* - Not working according to regulations/procedures - Fraud/theft/information leakage - Unauthorized .....




Equipment	Functions incorrectly Disturbs Is lost or severely damaged	*Spontaneous technical failure:* - Aging/wear - Malfunction - Design/manufacturing/installation/maintenance errors




		*Technical failure due to external influences:* - Power outage - Poor climate control - Negligent ......






		*Human actions/failures:* - Installation error - Wrong settings - Operating errors - Intentional ..........








Software	Functions incorrectly Crashes or delayed execution Gets lost or becomes serious	*Negligent human acts:* - Design, programming, implementation, management/maintenance errors - Introduction of virus and the like. by using unscreened programs - Using the wrong version of software - Poor documentation





		*Unintentional human acts:* - Errors due to incorrect following of procedures - Installation of malware and viruses due to the use of incorrect authorizations



		*Deliberate human acts:* - Manipulation before or after commissioning - (Unauthorized) change of function and/or addition - Installation of viruses, Trojans, and similar - Hijacking of ......







		*Technical errors/defects:* - Errors in code software that disrupt operation - Backdoors in software for (unauthorized) access - Bugs/errors in code that could lead to exploits




		*Organizational errors:* - Supplier goes bankrupt - Not a good .....



Details	Are unjustly disclosed Are temporarily inaccessible Lost	*Via data carriers (CD/DVD/USB sticks/Hard disk/Backups/mobile devices):* - Theft/misplacement/leaks - Damage due to mishandling - Mismatched file formats - Faulty or no encryption - Erroneous or falsified






		*Via Cloud services:* - Unauthorized access by unauthorized parties (hackers/hosters) - Unauthorized .....



		*Via equipment:* - Physical writing or reading errors - Insufficient access restriction to equipment - Errors in .....





		*Via software:* - Faulty or manipulated software - Effects .....




		*Through people:* - (Un)intentional incorrect data entry, change or deletion of data - Unauthorized .....










Organization	Does not work according to established principles Reorganizes Merges or is dissolved	*User organization:* - Mismanagement - Poor allocation of tasks, powers, responsibilities - Unclear or missing codes of conduct - Absent, outdated, or unclear manuals/system documentation/work procedures - Insufficient ......










		*Management organization:* - Poor management policies - Insufficient ......





		*Development organization:* - Poor project management - Not ........






Surroundings	Is accessible to unauthorized persons Is damaged Is destroyed or severely damaged	*Housing:* - Unauthorized access to building(s) - Theft in workplaces - .......





		*Now:* - Failure of electricity, water, telephone - .......




		*Outside events:* - Natural disasters (flood, lightning, storm, earthquake, etc.) - Other .......





Services	Are not delivered as agreed Temporarily undeliverable Definitively no longer available	*Services are not provided as agreed:* - Poorly trained staff - High staff turnover - Insufficient capacity in staff - ......












		*Service provider services temporarily unavailable:* - Does not provide services in accordance with the agreement - ......






		*Services service provider will no longer be able to provide permanently:* - A service provider goes bankrupt - .....

For substantive questions, we consult our colleagues at meta-audit.nl or ask them yourself for a complete overview.

The principles and guidelines for the risk management process are described in detail in the ISO 31000 standard.

Xraised
Spotify