Risk management
Know what could hurt you most
Every business has more risks than it can fix at once. The risk register ranks them, gives each an owner and a plan, and shows which to deal with first.
See where you stand
Too many risks, no clear order.
Risks live in someone's head
Most small businesses know their worries but have not written them down. When that person is away, the list goes with them.
A spreadsheet that goes stale
A risk list built once and never reviewed gives false comfort. Nobody can tell what has changed or who is dealing with what.
Hard to explain the priority
Boards, insurers and clients want to know why you are fixing one thing before another.
What changes
From worries to a ranked list.
First
Your risks are written down in one register, each with a likelihood, an impact and an owner.
Then
Each risk gets a treatment plan with actions and due dates. The heat map shows what needs attention first.
Ongoing
Overdue treatments surface to the right people, and a report for your owner, insurer or auditor is generated from the live register.
How it works
How it works.
Risks go into one registerEach risk has an owner, a rating and a status.How this works underneath
Each entry records the title, category, likelihood, impact, owner, treatment status and linked security measures. Findings from your connected tools can be raised as risks, and a business context assessment can suggest entries for you to review and confirm.Every risk is rated the same wayOne method, so a "high" means the same thing everywhere.How this works underneath
Risks are scored on a five by five likelihood and impact grid. The scale labels and thresholds can be adjusted to match how your business describes risk.Treatments become tracked actionsEach fix has an owner and a due date.How this works underneath
Treatment actions appear in the Action Hub with owners and dates. Risks are linked to the SMB1001 security measures that address them, so treating a risk also closes a gap.
A small example
What this can look like.
- Situation
- The firm has a list of worries in an old spreadsheet and no one owns it.
- What changes
- Twelve risks go into the register. Two rate as high: shared logins and no tested backup restore.
- What happens next
- Each high risk gets an owner and a due date in the Action Hub.
- What the owner can say
- "Here is what we are fixing first, who owns it and when it is due."
This is an invented example to show how the module works. The names and figures are not a real customer's.
What is in it
What is in the risk module.
Risk register
Every identified risk with likelihood, impact, owner, treatment and status, kept in the platform.
Heat map
Your risks plotted by likelihood and impact so the urgent ones stand out.
Consistent scoring
One scoring method across the whole register, with scales you can adjust.
Treatment tracking
Owners, due dates and progress for every treatment plan, with overdue items surfaced.
Risk assessment reports
A report for your owner, insurer or auditor, generated from the live register.
Links to security measures
Each risk is mapped to the SMB1001 security measures that address it.
Questions
Common questions.
A written list of the things that could harm your business, with a rating, an owner and a plan for each. In CyberGrape it is live in the platform rather than a spreadsheet.
Yes. The likelihood and impact labels and the thresholds for low, moderate, high and extreme can be adjusted for your business.
No. Findings reported by your connected tools can be raised as risks and ranked with your other risks. For hands-on testing, see our penetration testing service.
Related
Works with.
Find out what could hurt you most.
The free readiness assessment shows you where you stand and what to fix first. If we are not the right fit, we will tell you that too.