> For the complete documentation index, see [llms.txt](https://docs.glesys.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.glesys.com/security/annex-information-security/3.-risk-management-strategy.md).

# 3. Risk Management Strategy

3.1 Glesys has established and maintains risk management processes in accordance with the Cyber Security Rules for the continuous identification, analysis, evaluation and treatment of cybersecurity risks affecting its network and information systems, including but not limited to:

a) risk assessments carried out and documented in accordance with a defined methodology, with outcomes recorded in a consolidated enterprise risk register, including a defined approach to evaluating impact, probability, prioritisation, ownership and treatment, and subject to regular executive review;

b) risk-based decision-making, whereby risk management is integrated with audits, business impact analyses, supplier assessments, incidents and major changes in e.g. Glesys’ operations or risks; and

c) risk-aware handling of changes affecting systems, services or controls are recorded, assessed proportionally, approved at the appropriate level and reviewed after implementation.

3.2 Glesys has established processes for conducting independent reviews of its risk-management strategies and frameworks regularly in accordance with the Cyber Security Rules. Glesys updates its policies as necessary and appropriate based on the findings of such reviews.