Featured guide
Create and assess a risk
Learn how to complete CIA and FAIR assessments, add controls, assign treatment actions and manage risk exceptions.
Read the guideRisk Management
Assess Asset-related exposure qualitatively or with FAIR, incorporate manual and scanner-derived technical evidence, then govern treatment, exceptions, reassessment and linked Controls or third parties.
Start with the workflow
From context to a governed Risk decision
Risk assessment links Asset value, threats, vulnerabilities, operating Controls, treatment and formal acceptance while preserving lifecycle history.
1
Identify
Start from an Asset and define threats, manual weaknesses and linked technical exposure.
2
Evaluate
Assess likelihood/impact or quantify one FAIR threat scenario.
3
Treat
Plan mitigation, transfer, avoidance, monitoring, escalation or acceptance.
4
Decide
Evaluate residual exposure against appetite and govern any exception.
5
Reassess
Create a new assessment version when conditions materially change.
Assessment paths
Choose the assessment that fits the decision
Qualitative assessment supports consistent register prioritisation; FAIR quantifies one specific threat scenario financially.
Qualitative
Complete a qualitative Risk assessment
Add vulnerabilities, threats and current Controls, then evaluate and treat the Risk.
GovernanceManage Risk exceptions and reassessments
Govern residual exposure above appetite and preserve assessment versions.
Technical evidenceUse technical exposure in assessment and reassessment
Link scanner evidence, assess grouped technical vulnerabilities and preserve live-versus-historical evidence correctly.
QuantitativeComplete a FAIR quantitative assessment
Estimate annual financial exposure for one defined threat using Monte Carlo simulation.
Implementation documentation
Plan the rollout and operate the module
Download the practical implementation handbook or the detailed technical reference for this module.
Handbook
Risk Management First-Time Implementation Handbook
Practical first rollout covering governance settings, qualitative/FAIR assessment, technical exposure, treatment, exceptions and reassessment.
Technical referenceRisk Management Technical Documentation v2.0
Architecture, technical-evidence linkage, assessment snapshots, reassessment, treatment, security, deployment and regression reference.
Important operating rules
Keep Risk semantics separate from connected module scores
Asset value, TPRM tier, Control implementation and Compliance status can inform Risk context, but they are not substitutes for the Risk assessment and its current/residual result.
- Qualitative assessments can consider multiple threats; FAIR scenarios analyse one specific threat at a time.
- Current Controls should reflect what is operating, while treatment actions represent planned changes.
- Rejected Risk exceptions return the exposure to treatment/reassessment rather than silently accepting it.
- Third-party and Control relationships provide context without transferring ownership of the Risk calculation.
- Scanner findings are linked as technical evidence and assessed in grouped form; they do not automatically become one Risk per finding.
- Download the Risk Management First-Time Implementation Handbook for rollout guidance and the Technical Documentation for architecture/operations detail.
No guidance matches that search.