B1MGplus D2.9 Risk management Standard framework Genome-EDIC

The present document is a deliverable (D2.9) of the B1MGplus project, entitled Risk Management Standard Framework Genome-EDIC. The report lays the foundation in terms of principles, definitions and logic of managing information and data protection security risks in the establishment, build-up and operations of the Genome-EDIC. Given the complexity of the area, the report describes first and foremost risk management on a conceptual level.

The Genome-EDIC Risk Management Framework (RMF) establishes a comprehensive system for managing risks within a hyper-complex, federated infrastructure processing sensitive genomic data. As this data processing constitutes a high risk to data subjects, the framework is essential for ensuring GDPR compliance, protecting the platform's reputation, and maintaining public trust. The system distinguishes between "risks" (potential harm) and "incidents" (actual events), with the primary goal of proactively managing risks before they escalate into incidents.

Aligned with ISO 31000 standards, the RMF is built upon three core pillars: principles, framework, and processes. The governing principles mandate that risk management must be integrated at every level, structured, evidence-based, and dynamic enough to adapt to new threats. The framework emphasizes that risk management is a collective responsibility, requiring personalization by each entity within the federation rather than a one-size-fits-all approach.

Effective implementation requires shifting focus from managing individual legal liabilities to a holistic protection of data subjects across the ecosystem. The document outlines critical processes for identifying, assessing, and treating risks, noting that internal operational decisions and human error often pose greater risks than external malicious attacks. Consequently, the RMF prioritizes robust communication channels and leadership commitment to embed a risk-aware culture throughout the Genome-EDIC.