A threat catalogue determines which threats you can select for risks, for example fire, malware or operating errors. You can map requirements to each threat, which Varmo then suggests in risk treatment. This article is aimed at ISMS managers who set up risk management.

Before you start

  • You need a functional role with the permission to configure risk management; by default, the ISMS managers have it.
  • You find the settings under ISMS settings › Risks › Threat catalogues and ISMS settings › Risks › Threats and requirements.
  • Every organisation starts with the catalogue BSI IT-Grundschutz: Elementare Gefährdungen (elementary threats, G 0.1 to G 0.47). It is maintained by Varmo and cannot be edited.
  • Threat catalogues are independent of the risk methodology: the catalogue provides the threats, the methodology determines how likelihood and impact are assessed.

Activating catalogues

  1. Open ISMS settings › Risks › Threat catalogues.
  2. In the For risks column, tick each catalogue whose threats should be available for selection on risks. Any number of catalogues can be active at the same time.

If you deactivate a catalogue, its threats are no longer available for selection on new risks. Existing risks keep their threats.

Creating a custom catalogue

  1. Click Create custom catalogue.
  2. Under Catalogue, enter a Name, and optionally Description, Source and Version.
  3. Use Add category to create categories, for example “Environment”, each with an abbreviation and name.
  4. Use Add threat to add the threats: identifier, name (e.g. “Flooding”) and the affected security objectives confidentiality, integrity and availability. In the details, you add a description and category.
  5. Click Create catalogue.
  6. Activate the new catalogue as described above. Only then are its threats available for selection on risks.

You change custom catalogues later via Edit. If you delete a custom catalogue, its threats are deleted as well, and risks that refer to them lose this link.

Mapping threats and requirements

Which requirements work against a threat? This mapping suggests suitable requirements in risk treatment and shows in the cross-check where a necessary requirement might be missing. In treatment, the selection is always made by hand.

  1. Open ISMS settings › Risks › Threats and requirements. The page needs an active threat catalogue and an adopted requirement catalogue, see Adopting requirement catalogues and keeping them up to date.
  2. For the BSI threats, there is a standard mapping with requirements from ISO/IEC 27001 Annex A. Click the pencil icon next to a threat to edit the mapping.
  3. In the Requirements for the threat dialog, you see the standard mapping and your own mappings under Suggested. If a standard mapping does not fit your organisation, click Deselect; under Deselected standard mappings, you bring it back with Include again.
  4. Under Add, you add further requirements, including from custom threat and requirement catalogues. You remove your own mappings with Remove.

What happens next

  • When reporting and assessing a risk, you choose threats from all active catalogues, see Reporting, reviewing and treating risks.
  • If you map requirements to a measure in risk treatment, Varmo suggests the requirements for the threats of the risk. With the tick box Remember as a suggestion for the threat of this risk, you save your choice as your own mapping.
  • In the cross-check under Requirements › Annex A cross-check, Varmo shows threats of treated risks without a matching requirement, see Setting applicability and approving the SoA.

Frequently asked questions

Can I adapt the BSI catalogue?

No. It remains unchanged. You record your own threats in a custom catalogue, which you activate in addition.

The “Threats and requirements” page is empty.

First activate a threat catalogue and adopt a requirement catalogue. Without requirements, there is nothing to map.

Do I have to adopt the suggested requirements?

No. The suggestions help with the selection. You decide yourself in risk treatment which requirements a measure implements.