A formal risk management program is documented within the risk management policy as well as the Employee Handbook and are available to both internal and external system users.
GitLab has established and maintained a risk management program which includes a formal Risk Management Policy that is documented in the Handbook and available to both internal and external system users. The risk management policy is reviewed on an annual basis and any changes or updates needed to be made to the policy are made accordingly.
This control is applicable to the GitLab organization as a whole.
All GitLab employees are subject to the risk management policies. Security Compliance is the ultimate owner of the risk management process as a whole and gathers inputs from other various risk assessment related activities that occur throughout GitLab, such as vendor security reviews or fraud risk assessments performed by the Internal Audit function.
Non-public information relating to this security control as well as links to the work associated with various phases of project work can be found in the Risk Management Policy control issue.