Assessments get outdated: systems change, new vulnerabilities appear, information becomes more important. That is why Ariadne ISMS automatically schedules a reassessment for information and risks. Your ISMS stays current, and you always see what is due right now.
What becomes due when
Information
Due date based on the protection level
- By default, new information becomes due for the first time after 90 days.
- After each security classification, the next due date depends on the higher value of confidentiality and integrity.
- The privacy classification does not affect the due date.
Risks
Due date based on the risk score
- After each assessment, the next due date depends on the score range: the more critical, the sooner.
- Accepted risks also stay in the reassessment cycle.
- When you complete a treatment, the risk is immediately marked for reassessment.
Default intervals
These are the product defaults. Your admin can adjust them, so they may differ in your organization.
| Information (higher value of C and I) | Interval | Risks (score range) | Interval |
|---|---|---|---|
| Catastrophic | 90 days | Critical | 90 days |
| Severe | 180 days | High | 180 days |
| Medium | 365 days | Medium | 365 days |
| Low, Negligible | 730 days | Low | 730 days |
- Intervals for information: Settings > Information classification. An interval of 0 means there is no reassessment for that level.
- Intervals for risks: Settings > Risk treatment > Reassessment intervals.
Find due reassessments quickly
| Where | What you see |
|---|---|
| Overview | Due information and risks appear under Action required. The bars for information and risks show overdue assessments separately. |
| Lists | In Information and Risks, filter by Reassessment. Risks with an overdue assessment show the note Risk assessment overdue. |
| Risk management | Outdated assessments count in their last score range and also appear in the "of these overdue" column. |
| On the risk | Next steps shows Perform risk assessment with the Assess button. An overdue reassessment always takes priority over other steps. |
Bring a reassessment forward when something changes
You don't have to wait for the next due date. If there is a new vulnerability, an incident, or a change to an asset or process, request a reassessment of the risk manually.
- The existing treatment remains valid until the new assessment is in place.
- If a new assessment would replace an ongoing treatment, the ISMS asks you to confirm. For accepted risks, it only asks if the new score is higher.
What about business processes?
For business processes, the ISMS shows an action as long as there is no BIA yet. The process then carries the BIA pending badge. If your admin changes the BIA configuration or support changes the impact scale, the ISMS recalculates the BIA and MTPD automatically.
Related articles
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article