Risk Scoring

This is the help text the console shows in the help panel on this page.

This page is the detailed risk assessment workspace for a single asset. For each identified threat, you set likelihood and impact to calculate a risk score, then choose a treatment approach.

Risk Score Calculation

Risk Score = Likelihood × Impact (both rated 1–5, yielding scores from 1–25). Scores are colored in the table:

• 1–7: Low (green) — monitor and accept where appropriate.
• 8–14: Medium (orange) — mitigate with standard controls.
• 15–25: High (red) — treat as a priority. A warning appears at the top of the page when any risk scores 15 or more.

Adding Threats

Click Add Threat Manually to fill in a threat name, likelihood, impact, treatment and notes; the score is calculated for you. Click Generate AI Threats to get suggestions instead.

AI Suggestions

The AI Threat Suggestions panel lists plausible threats for the asset. Click Accept to add one to the register, Reject to dismiss it, or Dismiss all to clear the list.

Approval

Once the risks are scored and treatments chosen, click Approve All Risks (Owners and Managers). Each risk then shows an approval date in the Approved column; unapproved risks show Pending.

ISO 27001 Requirement

ISO 27001 clause 6.1.2 requires defined likelihood/impact criteria and a chosen treatment option for each risk.

Fields

Threat Name

A concise description of the threat scenario.

Examples: Unauthorized access via compromised admin credentials, Data exfiltration through a misconfigured cloud storage bucket, Ransomware via phishing email.

Likelihood (1–5)

How probable is this threat occurring?

• 1 (Rare): Unlikely given current controls.
• 2 (Unlikely), 3 (Possible): Could occur under typical conditions.
• 4 (Likely), 5 (Almost Certain): Expected to occur without intervention.

Impact (1–5)

What is the business impact if this threat materializes?

• 1 (Negligible): Minimal disruption, no data loss.
• 2 (Minor), 3 (Moderate): Operational disruption, limited data exposure.
• 4 (Major), 5 (Catastrophic): Major breach, regulatory penalties, business continuity impact.

Risk Treatment

The chosen approach for addressing this risk:

• Mitigate: Implement controls to reduce likelihood or impact.
• Accept: Acknowledge the risk without further action (requires justification).
• Transfer: Shift the risk to a third party (e.g., via insurance or contract).
• Avoid: Eliminate the activity that creates the risk.

Treatment Notes

Describe the specific controls or actions planned to address this risk. This text becomes part of your ISMS documentation and will be reviewed by the auditor.