Skip to main content
The Risk Management module provides a structured risk register and a 5×5 visual heat map. Each risk is linked to an asset in the Asset Inventory, scored by likelihood and impact, and assigned a treatment strategy.

Page layout

The page is split into two panels:

Risk assessment form

A form for registering new risks. Select the asset, choose the compromised CIA pillars, set probability and impact, then define a treatment strategy with one or more Annex A controls.

Risk heat map

A 5×5 matrix plotting all registered risks by their residual probability and impact. Color zones indicate severity. Updates in real time as you fill the form.

Registering a risk

1

Open the Risk page

Navigate to Risk in the sidebar. The risk assessment form is on the left and the heat map on the right.
2

Select the asset

Choose the affected asset from the Activo Afectado dropdown. The list is populated from your Asset Inventory. If the asset does not exist yet, add it there first.
After selecting an asset, the Impact field is pre-filled based on the asset’s maximum CIA score for the selected pillars.
3

Select the compromised pillar(s)

Toggle one or more CIA pillars to indicate which security dimension the risk affects:
PillarDescription
C — ConfidencialidadThe risk compromises data secrecy
I — IntegridadThe risk compromises data accuracy or completeness
D — DisponibilidadThe risk compromises system or data availability
At least one pillar must remain selected at all times. Multiple pillars can be active simultaneously (multi-pillar risk).
4

Score inherent risk

Set Probabilidad (1–5) and Impacto (1–5) for the risk before any controls are applied.
Inherent risk = Probabilidad × Impacto
Risks with an inherent score ≥ 5 are classified as Alto (Inaceptable) and require formal treatment.
5

Choose a treatment strategy

For risks with inherent score ≥ 5, treatment is mandatory. Select from four ISO 31000-aligned options:
TreatmentDescription
MitigarApply Annex A controls to reduce likelihood and impact
AceptarFormally accept the risk with justification
TransferirShift risk to a third party (e.g. cyber insurance, outsourcing)
EvitarStop the activity that gives rise to the risk
For Aceptar, Transferir, and Evitar, you must provide a written justification explaining the management decision.
6

Add Annex A mitigation controls (if Mitigar)

If the treatment is Mitigar, you must add at least one control from the Annex A library:
  1. Select a control from the Buscar un Control Anexo A dropdown.
  2. Set the Eficacia del Control (10–100%) using the slider.
  3. Click + Añadir Control to add it to the mitigation stack.
  4. Repeat to add multiple controls (defense-in-depth).
Combined efficacy is calculated using the defense-in-depth formula:
Combined failure rate = ∏(1 − efficacy_i / 100) for each control
Combined efficacy = (1 − combined failure rate) × 100
The form shows the resulting Residual Risk score in real time.
7

Save the risk

Click Registrar Evaluación to save the entry. The risk appears in the heat map and the register table immediately.

Risk heat map

The heat map plots every registered risk on a 5×5 grid with Probability on the y-axis and Impact on the x-axis. Risks are positioned using their residual likelihood and impact scores.

Color zones

Score rangeColorSeverity
1–4GreenLow
5–9YellowMedium
10–14OrangeHigh
15–25RedCritical
Risks positioned in the red zone (score ≥ 15) require immediate attention. Review the treatment strategy for any critical risk and consider whether the residual score can be reduced through additional controls.

Risk data reference

Each risk entry stored in the register contains the following fields:
FieldTypeDescription
idstringAuto-generated identifier (e.g. R001)
assetIdstringLinked asset identifier
pillarsstring[]Compromised CIA pillars, e.g. ['C', 'I']
probability1–5Inherent probability score
impact1–5Inherent impact score (auto-set from asset CIA)
treatmentOptionenumMitigar | Aceptar | Transferir | Evitar
treatmentJustificationstringRequired justification for non-Mitigar treatments
controls{id, efficacy}[] | nullApplied Annex A controls with efficacy % (Mitigar only)
residualRisk1–25Residual score after applying controls
dateISO dateDate the risk was registered
The controls field stores an array of objects — one per Annex A control — rather than a single text description. Each entry has an id (Annex A control ID, e.g. A.8.13) and an efficacy value (10–100).

Clause 6 integration

The risk assessment form and heat map are also embedded directly inside Clause 6 of the Clauses 4–10 module. Any risks you add from either location are shared — the register is the same data source regardless of where you enter risks.

Frequently asked questions

Yes. Click any risk entry in the register table to open its edit form. To delete a risk, use the delete action on the risk row. Note that deleting an asset also removes all risks associated with that asset.
A residual risk score of 1 means both residual likelihood and residual impact are set to 1, the minimum values. This indicates the risk is considered negligible after treatment. Verify that the stated control actually achieves this level of reduction before accepting the score.
No hard limit is enforced. However, localStorage has a browser-imposed storage cap (typically 5–10 MB). For most organisations, this limit is well above what a realistic risk register requires.

Build docs developers (and LLMs) love