Risk assessments in Diri follow a five-step process, from registering what you assess to signing the treatment plan and accepting the residual risk. The risks you identify are gathered in the risk registry, where they can be followed up, accepted or escalated.
Risk assessments belong to a module. In the left menu you find them under the Operational risk and Cyber security groups, each with its own Risk Assessment, Risk Registry, asset registry (Business Assets or Information assets), Threats, Vulnerabilities and Templates. Privacy risk is assessed in DPIAs, see DPIA.
¶ Risk follow-up and decisions
- The Risk Registry - all risks across your assessments, with current and residual risk, owner and acceptance status
- Risk acceptance - accepting and escalating risks, the risk acceptance register and acceptance thresholds
- Signing and review - sending assessments for signing, review periods and what breaks a signature
- Bulk import - import causes, events, consequences and treatments into the bowtie work surface from Excel or CSV
- Dependencies - simulate what happens if a system goes down or is compromised, and record the result as a risk
- Pre-assessments - screen vendors, IT systems and business processes before deciding on a full risk assessment
- Treatments - follow up all treatments in your organisation