This is where risk analyses are managed, from definition to potential acceptance.
ISO 27005 risk management workflow
Risk assessment
You can create risk assessments in your perimeters. A risk assessment encompasses:
risk identification, when you define your risk scenarios
risk analysis, when you assess the probability, impact and strength of knowledge for each scenario
risk evaluation, which is done automatically based on the selected risk matrix
In CISO Assistant, risk treatment is combined with risk assessment.
Risk scenario
The scenarios can be defined directly from the risk assessment view or separately via this view.
Risk acceptance
Risk acceptance is when an organization or individual decides to tolerate a certain level of risk without taking further action to reduce it.
This view allows to manage a workflow to get formal approval of risk acceptances by the management.
The approver of a risk acceptance must have a user account with approver role.
To find out more about risk acceptance, you can have a look to the ENISA risk management process.
