FEATURES · RISK MANAGEMENT

Assess, treat and own your risks.

From an employee’s first report to the formal acceptance of the residual risk: every step has a responsible role, and every decision is justified and traceable.

Request a demo Try it free

WHAT YOU GET

Reporting by all employees, anonymously if they wish
BSI threat catalogue G 0.1 to G 0.47 and your own catalogues
Methodology based on BSI Standard 200-3, 5×5, 6×6 or your own
Risk treatment plan under ISO/IEC 27001 6.1.3 at the push of a button

Report and review

All employees can report risks, anonymously if they wish. A reviewer role assesses the report and assigns it to a risk owner.

Reporting without the right to assess
Review by a defined functional role
Required fields configurable per phase

Form “Report risk” on a mobile phone with a note to report acute events as a security incident. — Every employee can report a risk in a few fields; the assessment comes later.

Your methodology

Assess risks following BSI Standard 200-3 or with your own 5×5 or 6×6 matrix, optionally with impact categories such as financial or reputational.

Likelihood and impact
BSI threat catalogue and your own catalogues
Risk level derived automatically from the matrix

A traceable workflow for every risk

Each risk shows where it sits in the matrix and where the measures are meant to take it, who is up next and which steps follow: assessment of the residual risk under the four-eyes principle, the risk owner’s decision and regular reviews.

Risk matrix of the risk “Ransomware attack”: initial risk “very high” (frequent, threatens the existence of the organisation), expected residual risk after the measures “medium” (medium, considerable), i.e. two levels lower. — The risk matrix shows where the measures are meant to take the risk: from “very high” to “medium”.

Treatment with a plan

For every risk you decide: reduce, avoid, transfer or accept. Measures and the expected residual risk are set right away, and the risk owner approves the treatment plan.

Measures with responsible people and due dates
Expected residual risk and comparison after implementation
Four-eyes principle when assessing the residual risk

Risk treatment plan: initial and expected risk for each risk, approval by the risk owner, measures with status, responsible person and deadline, and the related requirements. — The plan under ISO/IEC 27001 6.1.3 is built from the risks and measures, without copying anything across.

Acceptance against defined criteria

For each risk level you define who may accept: the risk owner alone, with approval by a functional role such as top management, or nobody at all. Regular reviews keep the assessment up to date.

Risk acceptance criteria per level
Approval by management where required
Periodic review by the risk owner

Measures & internal controls
Implement the treatment and back it up with evidence.
Assets & protection requirements
The basis of every risk assessment.
Glossary
Risk owner, residual risk and other terms.

Frequently asked questions

Can we use our existing risk matrix?

Yes. Besides the BSI default, there are templates for 5×5 and 6×6 matrices whose levels, descriptions and colours you define yourself.

What happens if measures do not go as planned?

If recurring measures or internal controls are missed or carried out with deviations, the risk owner is prompted to have the risk reassessed.

How is the risk treatment plan created?

From your data: for every risk, the treatment, measures, responsible people, due dates and expected residual risk are already defined. The plan can be printed and exported as CSV.

How close are you to ISO/IEC 27001?

In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.