POLICIES & AGREEMENTS
Technology Risk
Last updated October 23, 2026
Heavenly IT LLC, an Idaho limited liability company. Your signed Master Services Agreement governs. Questions: legal@heavenlyit.com.
Every environment has some risk. This page explains how we record it, how you decide what to do about it, and what happens when a recommendation is declined.
Risk Assessment
A Risk Assessment records each finding’s condition, evidence, severity, business impact, recommendation and remediation timeframe. Severity levels are Informational, Low, Moderate, High and Critical. Findings come from Discovery, monitoring, security alerts and periodic reviews.
Technology Risk Acceptance (TRA)
A TRA records an authorized decision to accept or defer a specific identified risk under stated conditions. It is signed by an Authorized Contact and includes a remediation target and a follow-up date. A TRA is not permanent amnesty, and it documents that specific risk decision only; it does not waive all liability.
Declined recommendations
Our security and lifecycle recommendations are made in writing, by email, ticket, report or Risk Assessment. Whether to act on them is your decision. If you decline or defer a recommendation, or do not act on it within the timeframe it states, that decision is recorded as your acceptance of the risk, whether or not a TRA is signed. Heavenly IT is not responsible for losses the recommendation was designed to prevent, and work caused by the accepted risk is billable. See Section 14 of the Master Services Agreement.
When a risk is not resolved
Unresolved risks can require reassessment, a Risk Management Adjustment, revised pricing, scope limits, or our refusal to continue managing the affected system. Legacy systems kept under a TRA are supported on a best-effort basis, and response targets do not apply to them. If a risk makes it unsafe for us to keep managing your environment and it is not addressed, we may end the affected Service Order on 30 days’ written notice with no early termination fee.
Emergencies
Where a risk becomes an active threat, we may act under Torn Veil emergency authority, if authorized in your Service Order, to isolate devices or disable accounts, and we report every action afterwards.