ISMS: Capture, assess and treat risks

Risk management in Ariadne ISMS lets you record every risk as a concrete scenario on an asset, assess it in a traceable way and decide how to handle it. That way you always know which risks you are carrying, which ones you are reducing right now and when you need to look at them again.

Prerequisites

• The affected asset exists in the ISMS module. Every risk relates to exactly one asset.
• Any role can create risks. You can assess a risk and define its treatment as the risk's Owner or as a Key User or Admin.

The process at a glance

Every risk goes through the same steps. The Next steps sidebar always shows you which step is due.

Capture a risk

There are two ways to create a risk:

• On the asset: Open the asset and click + next to Risks in the sidebar. The asset is then already preselected.
• From the risk list: Click Risks > + Create and select the asset.

Type a title into the Enter risk title or search in catalog… field. If an entry from the risk catalog fits, click it. Its title, description, category and tags are copied over. If nothing fits, create the risk with your own title via Create a risk named ….

Manage or discard a risk

A new risk starts as a proposal. Before you can assess it, take it into handling via … > Manage risk. If it does not apply, discard it with Discard risk.

Assess a risk and understand the score

In Next steps, click Assess next to Perform risk assessment. In the Assess risk dialog you choose:

• Impact: How big would the damage be if the scenario occurred?
• Likelihood: How likely is it to occur?
• Add rationale (optional): Your reasoning. Briefly explain why the levels fit, for example affected information, existing safeguards, vulnerabilities, dependencies or uncertainties. This keeps the assessment traceable, including in an audit.

The system calculates the Risk score from impact × likelihood and assigns a criticality. By default it looks like this:

By default, impact and likelihood each have five levels, from Negligible to Catastrophic and from Rare to Almost certain. The impact scale is the same one you use to classify information and to perform the BIA.

Automatic acceptance

Your admin can set an Auto-accept threshold. If a risk's score is below it, the risk can be accepted automatically. If it is above, you define the treatment yourself. By default the threshold is 0, so automatic acceptance is off.

Decide how to handle the risk

In Next steps, click Define next to Define how to handle the risk. You have four options:

Accept

Carry the risk knowingly

Accept

You document that you know the risk and carry it on purpose. The decision stays traceable without spending effort on disproportionate measures.

When do I use this?

• The risk is within your acceptance criteria.
• Further measures would be disproportionate.

Tip: Acceptance has no completion step. Accepted risks still come back at their next reassessment.

Reduce

Lower the risk with measures

Reduce

You plan measures that lower the likelihood, the impact or both. This is the most common route when a risk is too high.

When do I use this?

• The risk is above your acceptance limit.
• There are sensible measures, for example MFA or an authorization concept.

Tip: You then create the measures directly on the risk. Their deadline is the target date you set here.

Avoid

Stop or change the source of risk

Avoid

You stop, change or never start the risky activity. The scenario then no longer applies.

When do I use this?

• The benefit of the activity does not justify the risk.
• There is an alternative without this scenario.

Share

Share the risk with third parties

Share

You spread the risk to third parties by contract, organizationally or financially, so you do not carry it alone.

When do I use this?

• A service provider takes over operation under a contract.
• An insurance policy covers the financial damage.

Enter a Rationale in the dialog. For Reduce, Avoid and Share you also document a Responsible person and a Target date. Without a target date, Save treatment stays disabled.

Same treatment, different terms

Depending on where you look in Ariadne ISMS, the same treatment has a different name. This table helps you filter and read the dashboard:

Complete the treatment and know your residual risk

Once the measures are done, click Complete next to Complete risk treatment in Next steps. You can add a closing note if you like. The risk is then immediately flagged for reassessment.

The reassessment shows your residual risk, meaning how high the risk still is after treatment. There is no separate object for it. It is simply the risk's new assessment.

Request a reassessment outside the schedule

Is there a new vulnerability, an incident, or has the asset or process changed? Then request a reassessment manually. The existing treatment remains valid until the new assessment is in place. If the new assessment replaces an ongoing treatment, the system asks you to confirm. For accepted risks this only happens if the new score is higher.

Always know what to do next

The Next steps sidebar on the risk shows exactly the action that makes sense right now:

An overdue reassessment always takes priority. In the risk list you can spot it by the Risk assessment overdue label.

Record the affected protection goals

Under Affected protection goals you record which protection goals the risk affects: Confidentiality, Integrity or Availability. Confirm with Save protection goals.

Keep your risks meaningful

• Scenarios, not keywords: “Unauthorized access to the CRM via compromised credentials” is better than “hackers”.
• Use rationales: Others can then understand later why you assessed and decided the way you did.
• Involve experts: If you are unsure, bring in the affected departments.
• Create measures as separate objects as soon as work needs to be planned or checked.
• Only complete once implementation is documented, and always reassess afterwards.

Related articles

• ISMS: Plan, implement and document measures
• ISMS: Create assets, maintain dependencies and derive required protection
• ISMS: Dashboards: keep track of pending actions and the risk landscape
• ISMS: Settings, default values and data import