regulator-portal-service — Service Risk Register
Version: 1.0 Status: Draft Owner: Regulator-facing + Legal + Security + SRE Last Updated: 2026-04-21 References: FAILURE_MODES.md, SECURITY_MODEL.md
Scored 1–5 Likelihood × Impact; residual ≤ Medium required for GA.
1. Risk Summary
| ID | Risk | Category | L | I | Pre | Residual | Owner |
|---|---|---|---|---|---|---|---|
| REG-RISK-01 | ATRA PKI not finalised at launch | Regulatory | 4 | 4 | High | Medium | Regulator Liaison |
| REG-RISK-02 | SIEM destination schema vendor changes (Splunk/LEEF vendor) | Dependency | 3 | 3 | Medium | Medium | Security |
| REG-RISK-03 | LI workflow SLA breach → regulator penalty | Availability | 3 | 5 | High | Medium | Legal + SRE |
| REG-RISK-04 | HSM outage during report-signing window | Dependency | 2 | 4 | Medium | Low | Security + SRE |
| REG-RISK-05 | Upstream unavailability → incomplete report → regulator trust impact | Integration | 3 | 3 | Medium | Low | SRE |
| REG-RISK-06 | Auditor portal credential compromise | Security | 2 | 4 | Medium | Low | Security |
| REG-RISK-07 | Evidence auto-collection false positive (CURRENT when actually stale) | Correctness | 3 | 3 | Medium | Medium | Compliance |
| REG-RISK-08 | Disk-WAL fills during prolonged SIEM outage → event loss | Availability | 2 | 4 | Medium | Low | SRE |
| REG-RISK-09 | Regulator cert-revocation propagation delay (CRL cache freshness) | Security | 3 | 3 | Medium | Low | Security |
| REG-RISK-10 | Complaint-triage classifier bias | ML fairness | 2 | 3 | Medium | Low | T&S |
| REG-RISK-11 | Multi-region portal: data residency concern (sovereign vs. DR) | Regulatory | 2 | 3 | Medium | Medium | Legal + Platform Arch |
| REG-RISK-12 | LI dual-control bottleneck off-hours | Process | 3 | 3 | Medium | Medium | Legal |
| REG-RISK-13 | Attestation-bundle regeneration after annual audit failure | Ops | 2 | 2 | Low | Low | Compliance |
| REG-RISK-14 | Cross-jurisdictional LI request (rare but possible) | Legal | 1 | 4 | Medium | Medium | Legal |
2. Risk Details
REG-RISK-01 — ATRA PKI not finalised
Mitigation. Interim Ghasi Government Trust Anchor (per cbc-bridge CBC-RISK-01 mitigation); migrate when ATRA PKI available. Legal MoU defines interim model.
Residual. Medium.
REG-RISK-02 — SIEM schema change
Mitigation. Adapter per destination; multi-destination fan-out; vendor-change notice tracked. SIEM-destination-unreachable alert catches cutover-gone-wrong.
Residual. Medium.
REG-RISK-03 — LI SLA breach
Mitigation. SLA timers + alerts at 75% of budget. Emergency-approver runbook for edge cases. Multi-region standby. Internal escalation to CISO on breach.
Residual. Medium.
REG-RISK-04 — HSM outage
Mitigation. HSM HA. Reports queue on sign failure. Backup manual-signing procedure with dual-control.
Residual. Low.
REG-RISK-05 — Upstream unavailability
Mitigation. Partial-report mode with warning banner. Status-page dashboard for regulator visibility.
Residual. Low.
REG-RISK-06 — Auditor credential compromise
Mitigation. mTLS with auditor PKI; time-boxed access (default 30 d); session logging + anomaly detection; revocation within 5 min of compromise report.
Residual. Low.
REG-RISK-07 — Evidence false-positive
Mitigation. Multi-source evidence validation where practical (cross-check evidence against two upstream sources). Quarterly Compliance-review against CURRENT evidence.
Residual. Medium.
REG-RISK-08 — WAL fill event loss
Mitigation. 50 GB WAL sized for 7-day outage; alerts at 50/75/90%; manual expansion procedure; Legal-approval required for any event drop.
Residual. Low.
REG-RISK-09 — Cert revocation delay
Mitigation. CRL cache 4 h TTL; OCSP staple required for active sessions; manual cert-block runbook for urgent cases.
Residual. Low.
REG-RISK-10 — Triage classifier bias
Mitigation. Fairness audit; human-in-loop for all complaint categorisations at launch; classifier shifts to advisory-only until audit passes.
Residual. Low.
REG-RISK-11 — Data residency
Mitigation. Regulator portal sovereign-region only. DR region is Afghan (mzr) not Dubai. Dubai retains only audit-mirror (LI events + attestation evidence) with Legal-approved data residency policy.
Residual. Medium.
REG-RISK-12 — Off-hours LI approver
Mitigation. Emergency-approver rotation (CISO + CTO on-call). Dual-control window 60 s during business hours; extended window with documented approval out-of-hours.
Residual. Medium.
REG-RISK-13 — Bundle regeneration fail
Mitigation. Idempotent bundle generator; manual re-run available.
Residual. Low.
REG-RISK-14 — Cross-jurisdictional LI
Mitigation. Legal-signed procedure. Refuse + escalate to MFA + Cabinet if valid legal authority uncertain. Logged extensively.
Residual. Medium.
3. Residual Summary
| Residual | Count |
|---|---|
| Low | 7 |
| Medium | 7 |
| High | 0 |
4. Review Cadence
- Weekly during dev.
- Monthly post-GA (all owners).
- Quarterly (CTO + CISO + Legal + Regulator Liaison).
- Annual (CEO-chaired; political risk + regulator relationship).