> For the complete documentation index, see [llms.txt](https://docs.extrahorizon.com/extrahorizon/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.extrahorizon.com/extrahorizon/exh-platform/compliance/exh-as-ots-software/ots-cloud-risks.md).

# OTS Cloud Risks

Risk Examples using OTS Cloud Platform

<table data-full-width="true"><thead><tr><th width="52.828125">Risk</th><th width="239.78125">Foreseeable Sequence of Events</th><th width="255.2421875">Hazardous Situation</th><th width="318.19140625">Harm</th><th width="800">Risk Control Measures</th></tr></thead><tbody><tr><td>R1</td><td>Misconfigured access / API exposure.</td><td>Unauthorized party gains access to PHI</td><td>Privacy breach, fines</td><td><ul><li><strong>Penetration Testing:</strong> Undergoes regular third-party penetration testing to validate security controls.</li><li><strong>Data Encryption:</strong> Encrypts data both at rest and in transit.</li><li><strong>Authentication Protocols:</strong> Supports secure authentication protocols for secure access.</li><li><strong>RBAC:</strong> Provides fine-grained role-based access control (RBAC).</li></ul></td></tr><tr><td>R2</td><td>Platform outage or network failure</td><td>User unable to retrieve or input critical data</td><td>Delay in diagnosis or treatment</td><td><p>Extra Horizon has implemented a set of controls to avoid outages and ensure quick recovery when distasters do take place.</p><ul><li><strong>High-Availability Architecture</strong>: Ensures robust system reliability.</li><li><strong>Disaster Recovery Testing</strong>: Regular tests for guaranteed business continuity.</li><li><strong>24/7 Monitoring and Support</strong>: Continuous oversight and on-call engineering support.</li><li><strong>ISO 27001 Certification</strong>: Adherence to certified security management standards.</li><li><strong>Service Level Agreement (SLA)</strong>: Clear, transparent commitments to meet client needs.</li></ul></td></tr><tr><td>R3</td><td>Sync bug or corrupted database</td><td>Inconsistent or incorrect patient data</td><td>Misdiagnosis, incorrect treatment</td><td><p>In order to ensure data integrity and seamless operations, it is crucial to implement comprehensive disaster recovery strategies. These strategies should encompass several key components:</p><ul><li><strong>Platform Logging</strong>: Accurate and consistent logging to monitor system performance and identify issues promptly.</li><li><strong>Well-defined RTO &#x26; RPO Objectives</strong>: Clearly established Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) to guide recovery efforts and minimize downtime.</li><li><strong>Disaster Recovery Plans</strong>: Detailed plans that outline specific procedures during a disaster to ensure business continuity.</li><li><strong>Primary &#x26; Secondary Backup Locations</strong>: Designation of multiple geographic locations for data backups to safeguard against local failures.</li><li><strong>Backup Management Procedures</strong>: Systematic processes for managing backups, including regular testing and validation to guarantee data can be restored quickly.</li></ul></td></tr><tr><td>R4</td><td>Vendor updates API or backend silently</td><td>Dependent system fails or behaves unexpectedly</td><td>Unreliable performance, clinical interruption</td><td><p>Extra Horizon has the following controls in place to assure correct change management:</p><ul><li><strong>Versioning</strong>: Strict semantic version included in the SLA</li><li><strong>Development Lifecycle:</strong> IEC62304 compliant software development &#x26; verification methodology</li><li><strong>Source Code Management:</strong> Code reviews &#x26; branch protection rules</li></ul></td></tr><tr><td>R5</td><td>Platform lacks detailed or timestamped logs</td><td>Inability to trace user actions</td><td>Regulatory non-compliance, inability to investigate</td><td><p>The following controls are in place to ensure auditability and traceability towards user and administrative interactions:</p><ul><li><strong>API Interactions:</strong> All interactions with the Extra Horizon platform occurs trough our REST API and is logged.</li><li><strong>Audit Trails:</strong> Audit trails are enabled and coded into the infrastructure to ensure traceability of actions and changes in each dedicated cluster.</li></ul></td></tr><tr><td>R6</td><td>Vendor ceases operation or deprecates services</td><td>Service unavailable permanently</td><td>Permanent data loss or app breakdown</td><td><p>The Contract with the OTS Cloud supplier contains the following controls:</p><ul><li><strong>Continuity License:</strong> Commercial continuity clause in case of insolvency</li><li><strong>EOL clauses and general support:</strong> Clear end of support and end of life process with a large window to provide the client to adjust or modify services as required.</li><li><strong>Transitioning clauses:</strong> Transition services &#x26; transition planning</li><li><strong>Data Access Tooling:</strong> API access for data exports</li></ul></td></tr><tr><td>R8</td><td>Platform backend is a black box</td><td>Cannot fully verify safety or performance</td><td>Unidentified faults in clinical use</td><td><p>Extra Horizon has proper procedures and processes in place to safely operate and manage the provide cluster to it's customers:</p><ul><li><strong>Compliant Management System:</strong> Extra Horizon is audited by third parties and can prove compliance with it's ISO13485, ISO27001 and IOS27701 certificates.</li><li><strong>Software Verification &#x26; Validation:</strong> Provide compliant documentation and test reports;</li></ul></td></tr><tr><td>R9</td><td>Vendor slow to respond to incidents</td><td>Long MTTR impacts clinical decisions</td><td>Delayed recovery and system unavailability</td><td><p>Extra Horizon has a compliant business continuity management procedure in place to ensure uptime:</p><ul><li><strong>Incident Management:</strong> Incident management procedure</li><li><strong>Business continuity:</strong> Frequent disaster recovery planning &#x26; testing</li><li><strong>24/7 Monitoring and Support</strong>: Continuous oversight and on-call engineering support.</li><li><strong>Well-defined RTO &#x26; RPO Objectives</strong>: Clearly established Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) to guide recovery efforts and minimize downtime.</li></ul></td></tr></tbody></table>