# OTS Cloud Risks

<table data-full-width="true"><thead><tr><th width="52.828125">Risk</th><th width="239.78125">Foreseeable Sequence of Events</th><th width="255.2421875">Hazardous Situation</th><th width="318.19140625">Harm</th><th width="800">Risk Control Measures</th></tr></thead><tbody><tr><td>R1</td><td>Misconfigured access / API exposure.</td><td>Unauthorized party gains access to PHI</td><td>Privacy breach, fines</td><td><ul><li><strong>Penetration Testing:</strong> Undergoes regular third-party penetration testing to validate security controls.</li><li><strong>Data Encryption:</strong> Encrypts data both at rest and in transit.</li><li><strong>Authentication Protocols:</strong> Supports secure authentication protocols for secure access.</li><li><strong>RBAC:</strong> Provides fine-grained role-based access control (RBAC).</li></ul></td></tr><tr><td>R2</td><td>Platform outage or network failure</td><td>User unable to retrieve or input critical data</td><td>Delay in diagnosis or treatment</td><td><p>Extra Horizon has implemented a set of controls to avoid outages and ensure quick recovery when distasters do take place.</p><ul><li><strong>High-Availability Architecture</strong>: Ensures robust system reliability.</li><li><strong>Disaster Recovery Testing</strong>: Regular tests for guaranteed business continuity.</li><li><strong>24/7 Monitoring and Support</strong>: Continuous oversight and on-call engineering support.</li><li><strong>ISO 27001 Certification</strong>: Adherence to certified security management standards.</li><li><strong>Service Level Agreement (SLA)</strong>: Clear, transparent commitments to meet client needs.</li></ul></td></tr><tr><td>R3</td><td>Sync bug or corrupted database</td><td>Inconsistent or incorrect patient data</td><td>Misdiagnosis, incorrect treatment</td><td><p>In order to ensure data integrity and seamless operations, it is crucial to implement comprehensive disaster recovery strategies. These strategies should encompass several key components:</p><ul><li><strong>Platform Logging</strong>: Accurate and consistent logging to monitor system performance and identify issues promptly.</li><li><strong>Well-defined RTO &#x26; RPO Objectives</strong>: Clearly established Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) to guide recovery efforts and minimize downtime.</li><li><strong>Disaster Recovery Plans</strong>: Detailed plans that outline specific procedures during a disaster to ensure business continuity.</li><li><strong>Primary &#x26; Secondary Backup Locations</strong>: Designation of multiple geographic locations for data backups to safeguard against local failures.</li><li><strong>Backup Management Procedures</strong>: Systematic processes for managing backups, including regular testing and validation to guarantee data can be restored quickly.</li></ul></td></tr><tr><td>R4</td><td>Vendor updates API or backend silently</td><td>Dependent system fails or behaves unexpectedly</td><td>Unreliable performance, clinical interruption</td><td><p>Extra Horizon has the following controls in place to assure correct change management:</p><ul><li><strong>Versioning</strong>: Strict semantic version included in the SLA</li><li><strong>Development Lifecycle:</strong> IEC62304 compliant software development &#x26; verification methodology</li><li><strong>Source Code Management:</strong> Code reviews &#x26; branch protection rules</li></ul></td></tr><tr><td>R5</td><td>Platform lacks detailed or timestamped logs</td><td>Inability to trace user actions</td><td>Regulatory non-compliance, inability to investigate</td><td><p>The following controls are in place to ensure auditability and traceability towards user and administrative interactions:</p><ul><li><strong>API Interactions:</strong> All interactions with the Extra Horizon platform occurs trough our REST API and is logged.</li><li><strong>Audit Trails:</strong> Audit trails are enabled and coded into the infrastructure to ensure traceability of actions and changes in each dedicated cluster.</li></ul></td></tr><tr><td>R6</td><td>Vendor ceases operation or deprecates services</td><td>Service unavailable permanently</td><td>Permanent data loss or app breakdown</td><td><p>The Contract with the OTS Cloud supplier contains the following controls:</p><ul><li><strong>Continuity License:</strong> Commercial continuity clause in case of insolvency</li><li><strong>EOL clauses and general support:</strong> Clear end of support and end of life process with a large window to provide the client to adjust or modify services as required.</li><li><strong>Transitioning clauses:</strong> Transition services &#x26; transition planning</li><li><strong>Data Access Tooling:</strong> API access for data exports</li></ul></td></tr><tr><td>R8</td><td>Platform backend is a black box</td><td>Cannot fully verify safety or performance</td><td>Unidentified faults in clinical use</td><td><p>Extra Horizon has proper procedures and processes in place to safely operate and manage the provide cluster to it's customers:</p><ul><li><strong>Compliant Management System:</strong> Extra Horizon is audited by third parties and can prove compliance with it's ISO13485, ISO27001 and IOS27701 certificates.</li><li><strong>Software Verification &#x26; Validation:</strong> Provide compliant documentation and test reports;</li></ul></td></tr><tr><td>R9</td><td>Vendor slow to respond to incidents</td><td>Long MTTR impacts clinical decisions</td><td>Delayed recovery and system unavailability</td><td><p>Extra Horizon has a compliant business continuity management procedure in place to ensure uptime:</p><ul><li><strong>Incident Management:</strong> Incident management procedure</li><li><strong>Business continuity:</strong> Frequent disaster recovery planning &#x26; testing</li><li><strong>24/7 Monitoring and Support</strong>: Continuous oversight and on-call engineering support.</li><li><strong>Well-defined RTO &#x26; RPO Objectives</strong>: Clearly established Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) to guide recovery efforts and minimize downtime.</li></ul></td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.extrahorizon.com/extrahorizon/exh-platform/compliance/exh-as-ots-software/ots-cloud-risks.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.