ISMS: Dashboards: keep track of pending actions and the risk landscape

Modified on Tue, 27 Oct at 2:30 PM

The two dashboards in Ariadne ISMS show you at a glance where someone needs to act and how your risk landscape looks. Every number and every bar is clickable and opens the matching filtered list. This takes you straight from the overview to the specific record.

Choose the right dashboard

You find both dashboards in the navigation under Dashboards. Each serves a different purpose:

Overview

All objects and open actions at a glance

Daily work

See how far you have got with business processes, information, assets, risks and measures, and what needs to happen next.

When do I use it?

  • You want to know what is on your desk today.
  • You check how complete your assessments are.
  • You look for deadlines due in the next 30 days.

Risk management

Risk landscape, risk matrix and trends

Steering & review

Use it to steer your risks and prepare the management review. You see how critical your risks are, how far treatment has progressed and how both develop over time.

When do I use it?

  • You want to find critical risks that still lack a decision.
  • You prepare the management review.
  • You look for hotspots by asset or owner.

In both dashboards, switch between the All and Assigned to me tabs at the top. You either see the status of the whole organization or only the records you own or are a stakeholder of.

See the status of your assessments in the Overview

The Overview shows three areas side by side: PRIMARY ASSETS (business processes and information), SECONDARY ASSETS (assets) and RISK MANAGEMENT (risks and measures). For each object you see a large number for the total, a distribution bar and a badge with open pending actions (e.g. "3 pending").

ObjectWhat is countedWhat the bar shows
Business processesall activeassessed (BIA available) / not assessed
Informationall activeassessed / reassessment overdue / not assessed
Assetsstatus Proposed, In evaluation, In useper status, additionally broken down by category
Risksstatus Managedassessed / reassessment overdue / not assessed
Measuresstatus Planned to Verifiedopen / implemented / verified

Information counts as assessed when both the security classification and the privacy classification are available and the reassessment is not overdue. Archived, discarded, canceled and out-of-use records are not counted.

Below the three areas you find two lists with six entries each:

  • Action required: records where someone needs to act.
  • Upcoming deadlines: deadlines in the next 30 days.

Click Show all → to open the complete list.

Know when an action becomes due

Pending actions show you where the next step is due. The number appears in the dashboard and as a badge next to the navigation entries. In the lists, use the Pending action filter to find them.

ObjectWhat to doWhen
RiskReview proposalstatus Proposed
Assessmanaged but not yet assessed
Reassessreassessment due
Define treatmentassessed but no treatment
Complete treatmenttarget date of the treatment exceeded
MeasureImplementopen and target date of the risk exceeded
InformationClassifysecurity or privacy classification missing
Reassessreassessment due
Business processPerform BIAno BIA yet
Good to know: Assets have no pending actions of their own. You recognize open decisions there by the numbers for Proposed and In evaluation.

Steer the risk landscape in the Risk management dashboard

The Risk management dashboard is designed for day-to-day steering and for the management review. It consists of these building blocks:

Building blockWhat it tells you
Key figures barNumber of risks per state: Managed, Critical, High, Medium, Low, Not assessed and Open proposals.
Risk landscape by criticality and treatment stateTable of criticality and treatment state with the columns Total, of these overdue, Retained, In treatment, Completed and Undecided. You immediately see where critical risks still lack a decision.
Risk matrixImpact × likelihood in the size of your scales, filterable by treatment state.
Criticality trend and Treatment state trendWeekly development over 12 months, plus the change compared to 90 days ago.
HotspotsRisks with pending actions, grouped by asset or owner (switchable).

If a risk's reassessment is overdue, it still counts in its last score range and is additionally flagged as overdue. This way, older risks do not disappear from the picture.

Map the treatment terms correctly

The ISMS names the treatment state differently in different places. This table helps you translate:

In the dialog on the riskIn the risk list filterIn the Risk management dashboard
AcceptAcceptedRetained
ReduceModifiedIn treatment
AvoidAvoidedIn treatment
ShareSharedIn treatment
– (no decision yet)UndecidedUndecided
– (treatment completed)CompletedCompleted

Prepare the management review

For the management review, use the Risk management dashboard directly. There is no separate report mode.

  • Use Risk landscape to show how many risks per criticality are accepted, in treatment or still undecided.
  • Use the trends to show how the situation has developed since the last review.
  • Use Hotspots to identify where management needs to provide resources or decisions.
Important: Dashboards and lists cannot be exported. Record the key figures for your management review minutes yourself, for example with a screenshot.
Good to know: Confidential records only appear in the dashboard for people who are allowed to see them. Two people may therefore see different numbers.

Related articles

Was this article helpful?

That’s Great!

Thank you for your feedback

Sorry! We couldn't be helpful

Thank you for your feedback

Let us know how can we improve this article!

Select at least one of the reasons
CAPTCHA verification is required.

Feedback sent

We appreciate your effort and will try to fix the article