Risks

Assessments

An assessment is a wiki-backed log of everything that could go wrong: each row is either a risk (something that might happen) or a gap (something missing today). Click New assessment to start one. The wizard first asks Which part of the company is this assessment about?: a group you assess separately, or All the rest. It then pre-loads every threat and gap your framework knows about, so you triage rather than start from a blank page. A new assessment for a group that already has one takes over from it. If the older one is still on the list, archive it when you no longer need it there.

Archive on a card takes an assessment off the active list, and Restore under Archived brings it back. To delete one for good, open its wiki page and delete it there. Only members who may change the organisation see Archive and Restore.

The Hub view: triage findings one by one

The Hub presents one finding at a time with the rest in a left column. For each row, set Likelihood 1 to 5, Impact 1 to 5, pick a Treatment (Mitigate / Accept / Transfer / Avoid), assign an Owner, leave notes, and click Confirm & next. Linked controls are pre-filled by the framework.

Below the linked controls, an Actions for this risk panel lists every framework-shipped action that addresses the selected finding, with priority, effort, and sprint badges. Picking Mitigate isn't an abstract decision; this is the concrete work you commit to. Click any row to open the action's detail page on the Roadmap.

Register

The Risk Register is a derived view: every confirmed risk across all your assessments. Applies to everyone holds the risks for the whole company; under it each group you assess separately has its own branch, and Everything else comes last. At the top, Your turn tells you how many risks still need a decision. Management approval shows who has to approve accepted risks, the roadmap and the maturity scores; Choose management names them. Your decision counts right away, even before approval. To change a risk, open it and click Open in the assessment.

• Score = Likelihood × Impact. Each row shows the score, the risk and its treatment (for example Mitigate or Accept)
• Controls: an opened risk shows the controls it is linked to, for example PR-AT-01-1
• Tags, Owner, Asset and Remediator are shown on the opened risk, next to Likelihood, Impact and the treatment text
• The cards at the top count High risks, Mitigated ones and Unlinked ones: risks with no controls attached. An unlinked risk has no treatment plan; open it and link the controls it addresses
• Export CSV dumps the register for management reports or to attach to a quarterly review

Scores per part of the company

One risk can weigh differently in different parts of the company. The same threat is low for the office and high for the warehouse. You keep one risk and split it into parts, each with its own Likelihood, Impact, Owner and Treatment.

While you review the assessment, or later in the register, open the risk, look at Applies to (it starts as the whole organisation), click Add a group and pick a group with Choose groups. The group starts with the same scores as now; change them afterwards. Everything that is not in a part is Everything else: it keeps the current scores and shows as not reviewed yet until you confirm. Every item of the risk sits in exactly one part.

Choose Does not apply to this group to take a group out of the risk, with a reason the auditor sees. When a part ends up with the same scores as the rest, you are offered Merge into Everything else (this line disappears). The register shows one row per risk, with the Highest score of the parts. Actions stay on the whole risk; when a part goes back to the rest, its actions move to the rest.

Groups that overlap, or that reach outside what the risk is about, are refused. If a group changes later and the parts stop fitting, the risk is flagged The parts of this risk no longer fit and lands in your to-do list. Put a part back with the rest, or pick another group.

Accepting a risk: review date, and a suggested exception

Accepting a risk needs a review date: until when the acceptance holds. Without one, the app refuses the acceptance.

An accepted risk suggests an exception on the measures it is linked to. It never applies one: an owner or administrator confirms it, with the reason and an end date capped at the review date. On a CyFun measure a confirmed row shows as a deviation and does not count as implemented. How that works, and what happens when the risk changes afterwards, is on Recording an exception.

Roadmap

The Roadmap is a sprint Kanban over the actions on every active assessment page. Like the findings, actions are pre-loaded from the framework: for CyFun Basic that's a dozen recommended actions (deploy EDR, enable MFA, set up automated backups, run patch management, deliver awareness training, …) each pre-linked to the findings it addresses. You don't usually add actions by hand: you re-prioritise the ones that came in the box. New action adds one by hand.

Drag a card across columns to change its phase, or drop it on Done when the work is finished. At the top, Management approval counts the actions with their sprint and date: a new sprint or date needs a new approval, ticking off an action does not. The filters Assignee, Tag and Show for narrow the board.

Each card shows the action title, a HIGH / MEDIUM / LOW priority pill, a short note, an effort letter (S / M / L), the assignee, the due date, and small → finding-id chips back-pointing to the risks the action addresses.